Heimdall constructs a Forwarded HTTP header after rule processing by inserting the request’s Host header directly into the header string. Because commas and semicolons are not sanitized, an attacker can embed additional header parameters. The result is a crafted Forwarded header that can misrepresent the client’s IP address to upstream services, potentially bypassing authentication or logging mechanisms. The vulnerability is a classic input validation flaw and an injection scenario, as indicated by CWE-20 and CWE-74.

The Heimdall service by dadrus, when operating in proxy mode, is vulnerable in every release prior to 0.17.17. Systems running those versions should be considered at risk if the proxy function is exposed to external traffic.

The CVSS score of 7 signifies a high severity effect, yet the EPSS score is currently unavailable and the issue is not listed in CISA’s KEV catalog. An attacker can exploit it remotely by sending a Host header containing commas or semicolons; the vulnerability does not require privileged access or local execution. The attack vector is largely network-based, and the exploit can lead to IP spoofing that compromises upstream service security controls.