Path Traversal Vulnerability in Heimdall Identity Aware Proxy

CVE-2026-42274

What is CVE-2026-42274?

Heimdall is a cloud-native Identity Aware Proxy and Access Control Decision service that suffered from a path traversal vulnerability prior to version 0.17.14. The issue arises because Heimdall conducts rule matching on unprocessed request paths, which can diverge from how downstream components normalize these paths. For example, requests such as /user/../admin can be wrongly authorized by Heimdall, while the downstream normalization leads to a different authorized path (/admin). This inconsistency may expose sensitive resources to unauthorized access. To mitigate this flaw, it is essential to update to version 0.17.14 or later.

References