Heimdall EUVD-2026-108749

Requires Heimdall to be running in proxy mode (the Forwarded header is only constructed in that deployment mode) on a vulnerable version <= 0.17.16. The attacker sends an incoming request whose Host header contains commas or semicolons (e.g. 'Host: evil.com,for=127.0.0.1'), which Heimdall inserts verbatim into the Forwarded header after pipeline execution. The decisive limiting factor is the upstream: exploitation only yields impact when an upstream service parses the Forwarded header per RFC 7239 and makes IP-based trust/access-control decisions on the for= value by itself, without relying on Heimdall's own access-control capabilities. Heimdall itself is not compromised (no confidentiality/integrity/availability impact to the proxy), and no authentication or user interaction is needed to inject the header (PR:N/UI:N).

This is a conditional, chained access-control-bypass flaw rather than a direct compromise of Heimdall itself. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a remote, unauthenticated trigger, but the AT:P (attack requirements present) and the VC:N/VI:N/VA:N / SC:H/SI:H split are the key signals: Heimdall's own confidentiality, integrity and availability are not affected (VC/VI/VA:N); all impact lands on the subsequent/upstream system (SC:H/SI:H), and only when that upstream parses the Forwarded header per RFC 7239 and trusts the attacker-injected for= value for access decisions. That upstream dependency is exactly why AT:P is set - the outcome is not fully under the attacker's control. No EPSS score and no KEV status were provided, so there is no evidence of active or widespread exploitation; this is NOT confirmed actively exploited. The GHSA advisory does contain concrete curl PoC commands demonstrating the injection, but the input does not mark it as confirmed working exploit code. The vendor/source assigns CVSS 7.0 and the vuln.today Decision label is this_week (not act_now/emergency), which aligns with a serious-but-conditional issue: prioritize remediation this week, especially where upstreams make IP-based trust decisions, but it is not a drop-everything network RCE.

An attacker sends a single crafted HTTP request to a Heimdall proxy-mode endpoint with a Host header containing commas/semicolons (e.g. 'Host: evil.com,for=127.0.0.1'), which Heimdall inserts unsanitized into the Forwarded header it generates for the upstream. An upstream admin panel or internal API that trusts a for= value in the Forwarded header then treats the request as originating from a trusted internal IP, bypassing IP-based access controls. A public PoC reference (working curl commands) exists in the GHSA advisory, but it is not verified as a packaged working exploit; the CVSS 4.0 vector shows a network, low-complexity, unauthenticated trigger whose success still depends on upstream trust behavior (AT:P).