CVE-2026-42272: Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

Vulnerability summary

CVE-2026-42272 is a high (CVSS 7.8) Improper Handling of Case Sensitivity vulnerability in dadrus heimdall. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.8% of scored vulnerabilities.

Timeline

1. 08-05-2026
   PublishedVulnerability first disclosed.
2. 08-05-2026
   Last modifiedVulnerability information updated.

Description

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.

• CWE-178Improper Handling of Case SensitivityThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
• CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.