- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/26/2026, heimdall recorded 2 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of heimdall and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding HeadersCVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy ModeCVE-2026-42274Heimdall: Authorization bypass via path normalization mismatchCVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypassCVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding Headers | Exploitation statusNot confirmed | FixYes | Published10/23/2026 | SeverityHigh |
CVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode | Exploitation statusNot confirmed | FixYes | Published10/23/2026 | SeverityHigh |
CVE-2026-42274Heimdall: Authorization bypass via path normalization mismatch | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityHigh |
CVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypass | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityHigh |
CVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityHigh |
CVE-2026-32811Heimdall: Path received via Envoy gRPC corrupted when containing query string | Exploitation statusActively exploited | FixYes | Published03/20/2026 | SeverityHigh |
6 Results | Page 1 of 1