Access Control Issue in Heimdall Identity Aware Proxy

CVE-2026-42272

What is CVE-2026-42272?

Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service, exhibits a vulnerability related to URL-encoded slashes (%2F) before version 0.17.14. The handling of these encodings is case-sensitive, which deviates from their defined case-insensitivity. Consequently, the lowercase version (%2f) may go unrecognized when the default setting 'allow_encoded_slashes' is turned off, potentially leading to inconsistencies in request path processing between Heimdall and upstream components. This can create an avenue for authorization bypass. The issue has been addressed and fixed in version 0.17.14. For more details and updates, please refer to the official advisory and related resources.

References