Detections
Analytics
SCA: security update for github.com/dadrus/heimdall (GHSA-3q34-rx83-r6mq)
high Tenable Self-Hosted Container Security Plugin ID 440905
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version
0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream
components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result
in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as
/user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to
be set to on or no_decode.) while the downstream ultimately processes a different, normalized path
(/admin). This issue has been patched in version 0.17.14. (CVE-2026-42274)
Solution
Update the github.com/dadrus/heimdall library and its related packages to version 0.17.14 or later.See Also
Plugin Details
Severity: High
ID: 440905
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 4/26/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.63
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-42274
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.8
Threat Score: 7.8
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/25/2026
Vulnerability Publication Date: 4/25/2026
Reference Information
CVE: CVE-2026-42274