Heimdall, a cloud‑native identity‑aware proxy, misencodes URLs received through the Envoy gRPC decision API in versions 0.7.0‑alpha through 0.17.10. The Go url library re‑encodes the query string as part of the path, converting /mypath?foo=bar into /mypath%3Ffoo=bar. Rules that match the unescaped path /mypath no longer match, allowing traffic to bypass rules that are not wildcarded. This flaw is a classic authorization bypass (CWE‑863) triggered by improper input handling (CWE‑116). The vulnerability can only lead to unintended access if Heimdall is configured with an “allow all” default rule; secure‑default enforcement introduced in v0.16.0 prevents the service from starting with such a permissive configuration unless the --insecure or --insecure‑skip‑secure‑default‑rule‑enforcement flags are used.

The affected product is Heimdall from vendor dadrus, specifically all releases from 0.7.0‑alpha through 0.17.10 inclusive. Version 0.17.11 and later include the fix.

The vulnerability carries a CVSS score of 8.2 (High) and an EPSS score of less than 1 %, indicating a low likelihood of exploitation, and it is not listed in CISA’s KEV catalog. Exploitation requires an Envoy configuration that routes decision requests to Heimdall and a permissive default rule; an attacker can send a crafted URL containing a query string through Envoy to trigger the bypass. With secure defaults enforced, exploitation is mitigated unless an administrator explicitly disables the protection.