CVE-2026-32811

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32811", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.696Z", "datePublished": "2026-03-20T01:52:08.415Z", "dateUpdated": "2026-03-21T03:00:29.146Z"}, "containers": {"cna": {"title": "Heimdall: Path received via Envoy gRPC corrupted when containing query string", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp"}, {"name": "https://github.com/dadrus/heimdall/pull/3106", "tags": ["x_refsource_MISC"], "url": "https://github.com/dadrus/heimdall/pull/3106"}, {"name": "https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502", "tags": ["x_refsource_MISC"], "url": "https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502"}, {"name": "https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147", "tags": ["x_refsource_MISC"], "url": "https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147"}], "affected": [{"vendor": "dadrus", "product": "heimdall", "versions": [{"version": ">= 0.7.0-alpha, < 0.17.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T01:52:08.415Z"}, "descriptions": [{"lang": "en", "value": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypassed. Envoy splits the requested URL into parts, and sends the parts individually to Heimdall. Although query and path are present in the API, the query field is documented to be always empty and the URL query is included in the path field. The implementation uses go's url library to reconstruct the url which automatically encodes special characters in the path. As a consequence, a parameter like /mypath?foo=bar to Path is escaped into /mypath%3Ffoo=bar. Subsequently, a rule matching /mypath no longer matches and is bypassed. The issue can only lead to unintended access if Heimdall is configured with an \"allow all\" default rule. Since v0.16.0, Heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure flag. This issue has been fixed in version 0.17.11."}], "source": {"advisory": "GHSA-r8x2-fhmf-6mxp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-21T02:59:59.540304Z", "id": "CVE-2026-32811", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-21T03:00:29.146Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32811", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-21T02:59:59.540304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-21T03:00:24.032Z"}}], "cna": {"title": "Heimdall: Path received via Envoy gRPC corrupted when containing query string", "source": {"advisory": "GHSA-r8x2-fhmf-6mxp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "dadrus", "product": "heimdall", "versions": [{"status": "affected", "version": ">= 0.7.0-alpha, < 0.17.11"}]}], "references": [{"url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp", "name": "https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dadrus/heimdall/pull/3106", "name": "https://github.com/dadrus/heimdall/pull/3106", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502", "name": "https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147", "name": "https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypassed. Envoy splits the requested URL into parts, and sends the parts individually to Heimdall. Although query and path are present in the API, the query field is documented to be always empty and the URL query is included in the path field. The implementation uses go's url library to reconstruct the url which automatically encodes special characters in the path. As a consequence, a parameter like /mypath?foo=bar to Path is escaped into /mypath%3Ffoo=bar. Subsequently, a rule matching /mypath no longer matches and is bypassed. The issue can only lead to unintended access if Heimdall is configured with an \"allow all\" default rule. Since v0.16.0, Heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure flag. This issue has been fixed in version 0.17.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T01:52:08.415Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32811", "state": "PUBLISHED", "dateUpdated": "2026-03-21T03:00:29.146Z", "dateReserved": "2026-03-16T17:35:36.696Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T01:52:08.415Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "heimdall", "vendor": "dadrus", "versions": [{"status": "affected", "version": ">= 0.7.0-alpha, < 0.17.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dadrus:heimdall:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FC50B38-5B44-4237-B80D-7C6BC29FFC0C", "versionEndExcluding": "0.17.11", "versionStartIncluding": "0.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypassed. Envoy splits the requested URL into parts, and sends the parts individually to Heimdall. Although query and path are present in the API, the query field is documented to be always empty and the URL query is included in the path field. The implementation uses go's url library to reconstruct the url which automatically encodes special characters in the path. As a consequence, a parameter like /mypath?foo=bar to Path is escaped into /mypath%3Ffoo=bar. Subsequently, a rule matching /mypath no longer matches and is bypassed. The issue can only lead to unintended access if Heimdall is configured with an \"allow all\" default rule. Since v0.16.0, Heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure flag. This issue has been fixed in version 0.17.11."}, {"lang": "es", "value": "Heimdall es un Proxy Consciente de la Identidad y un servicio de decisi\u00f3n de control de acceso nativo de la nube. Al usar Heimdall en modo API de decisi\u00f3n gRPC de Envoy con las versiones 0.7.0-alpha hasta 0.17.10, una codificaci\u00f3n incorrecta de la cadena de URL de consulta permite que se eludan reglas con expresiones de ruta sin comodines. Envoy divide la URL solicitada en partes y env\u00eda las partes individualmente a Heimdall. Aunque la consulta y la ruta est\u00e1n presentes en la API, el campo de consulta est\u00e1 documentado para estar siempre vac\u00edo y la consulta de la URL se incluye en el campo de ruta. La implementaci\u00f3n utiliza la biblioteca url de Go para reconstruir la URL, lo que codifica autom\u00e1ticamente los caracteres especiales en la ruta. Como consecuencia, un par\u00e1metro como /mypath?foo=bar a Path se escapa a /mypath%3Ffoo=bar. Posteriormente, una regla que coincide con /mypath ya no coincide y es eludida. El problema solo puede conducir a un acceso no intencionado si Heimdall est\u00e1 configurado con una regla predeterminada de 'permitir todo'. Desde la v0.16.0, Heimdall aplica valores predeterminados seguros y se niega a iniciar con dicha configuraci\u00f3n a menos que esta aplicaci\u00f3n se deshabilite expl\u00edcitamente, p. ej., a trav\u00e9s de --insecure-skip-secure-default-rule-enforcement o la bandera m\u00e1s amplia --insecure. Este problema ha sido solucionado en la versi\u00f3n 0.17.11."}], "id": "CVE-2026-32811", "lastModified": "2026-06-17T10:36:23.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32811", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-21T02:59:59.540304Z", "version": "2.0.3"}}]}, "published": "2026-03-20T02:16:34.857", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/dadrus/heimdall/pull/3106"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.7.0-alpha,0.17.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "heimdall", "source": "cna", "vendor": "dadrus"}, "product": "heimdall", "vendor": "dadrus"}], "analysis": {"en": {"generated_at": "2026-03-30T16:30:29.848127+00:00", "value": {"mitigation_remediation": ["Upgrade Heimdall to version 0.17.11 or newer, which resolves the URL encoding bug.", "If upgrading is delayed, run Heimdall without the --insecure or --insecure\u2011skip\u2011secure\u2011default\u2011rule\u2011enforcement flags and ensure that no \"allow all\" default rule is configured.", "Verify that solution uses secure defaults by confirming the service refuses to start with a permissive configuration unless intentionally overridden.", "Consider disabling or restricting the Envoy gRPC decision API for services that cannot run the patched version."], "summary": {"action": "Immediate Patch", "impact": "Authorization Bypass via Query String Escaping"}, "threat_synthesis": {"affected_systems": "The affected product is Heimdall from vendor dadrus, specifically all releases from 0.7.0\u2011alpha through 0.17.10 inclusive. Version 0.17.11 and later include the fix.", "description_and_impact": "Heimdall, a cloud\u2011native identity\u2011aware proxy, misencodes URLs received through the Envoy gRPC decision API in versions 0.7.0\u2011alpha through 0.17.10. The Go url library re\u2011encodes the query string as part of the path, converting /mypath?foo=bar into /mypath%3Ffoo=bar. Rules that match the unescaped path /mypath no longer match, allowing traffic to bypass rules that are not wildcarded. This flaw is a classic authorization bypass (CWE\u2011863) triggered by improper input handling (CWE\u2011116). The vulnerability can only lead to unintended access if Heimdall is configured with an \u201callow all\u201d default rule; secure\u2011default enforcement introduced in v0.16.0 prevents the service from starting with such a permissive configuration unless the --insecure or --insecure\u2011skip\u2011secure\u2011default\u2011rule\u2011enforcement flags are used.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.2 (High) and an EPSS score of less than 1\u202f%, indicating a low likelihood of exploitation, and it is not listed in CISA\u2019s KEV catalog. Exploitation requires an Envoy configuration that routes decision requests to Heimdall and a permissive default rule; an attacker can send a crafted URL containing a query string through Envoy to trigger the bypass. With secure defaults enforced, exploitation is mitigated unless an administrator explicitly disables the protection."}}}}, "created": "2026-03-20T08:53:11.656062+00:00", "updated": "2026-03-30T20:58:20.061282+00:00", "vendors": ["dadrus", "dadrus$PRODUCT$heimdall"]}