URL Bypassing Vulnerability in Heimdall Identity Aware Proxy

CVE-2026-32811

What is CVE-2026-32811?

Heimdall, a cloud native Identity Aware Proxy, suffers from a URL bypass vulnerability when used in envoy gRPC decision API mode within versions 0.7.0-alpha through 0.17.10. Incorrect encoding of the query URL string allows bypassing of access control rules with non-wildcard path expressions. Specifically, Envoy splits requested URLs and sends parts to Heimdall, but the query component is documented as always empty, leading to improper URL reconstruction. Consequently, parameters like '/mypath?foo=bar' get encoded incorrectly, preventing correct rule matching and potentially leading to unauthorized access if an 'allow all' rule is configured by default. Heimdall enforces stricter secure defaults starting from version 0.16.0, requiring intentional configurations to disable these protections. The vulnerability is addressed in Heimdall version 0.17.11.

References