Heimdall, a cloud native Identity Aware Proxy, extracts client IP addresses from the Forwarded (for=) and X-Forwarded-For headers when the trusted_proxies option is enabled. Prior to v0.17.17, the extracted values are not validated as syntactically correct IP addresses; malformed or obfuscated strings are accepted as valid IPs. This allows an attacker to supply crafted header values that impersonate any IP address, potentially bypassing access control decisions based on client IP and enabling unauthorized access to protected resources.

The vulnerability affects the Heimdall product from dadrus, specifically all releases before v0.17.17. Users running any earlier version with the trusted_proxies setting enabled are exposed to this flaw, while v0.17.17 and later contain the fix.

The CVSS score of 7 indicates a high severity, and the absence of an EPSS or KEV listing suggests a moderate exploitation likelihood under current public knowledge. The issue is exploitable remotely through the injection of malicious Forwarded or X-Forwarded-For headers; a threat actor can target any externally reachable instance configured to accept trusted proxies, making the attack vector attainable over standard HTTP/S communication.