CVE-2026-42272

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

State: Published
Severity: 7.8 High
Published: May 8, 2026
Updated: May 8, 2026
Reserved: Apr 26, 2026

Description

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.

Scores

CVSS	Score	Vector	Source
4.0	7.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N	GitHub_M

Weaknesses

CWE-436 Interpretation Conflict
CWE-178 Improper Handling of Case Sensitivity

Affected Products

Product	Versions
heimdalldadrus	< 0.17.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.