Detections
Analytics

SCA: security update for github.com/dadrus/heimdall (GHSA-r8x2-fhmf-6mxp)

high Tenable Cloud Security Plugin ID 438956

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall
 in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL
 string allows rules with non-wildcard path expressions to be bypassed. Envoy splits the requested URL into
 parts, and sends the parts individually to Heimdall. Although query and path are present in the API, the
 query field is documented to be always empty and the URL query is included in the path field. The
 implementation uses go's url library to reconstruct the url which automatically encodes special characters
 in the path. As a consequence, a parameter like /mypath?foo=bar to Path is escaped into /mypath%3Ffoo=bar.
 Subsequently, a rule matching /mypath no longer matches and is bypassed. The issue can only lead to
 unintended access if Heimdall is configured with an "allow all" default rule. Since v0.16.0, Heimdall
 enforces secure defaults and refuses to start with such a configuration unless this enforcement is
 explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure
 flag. This issue has been fixed in version 0.17.11. (CVE-2026-32811)

Solution

Update the github.com/dadrus/heimdall library and its related packages to version 0.17.11 or later.

See Also

https://github.com/advisories/GHSA-r8x2-fhmf-6mxp

Plugin Details

Severity: High

ID: 438956

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 3/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-32811

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/18/2026

Vulnerability Publication Date: 3/18/2026

Reference Information

CVE: CVE-2026-32811