The vulnerability is a Server‑Side Request Forgery (CWE‑918) in the Tenable proxy endpoint of MITRE SAF Heimdall. A remote attacker can trick the application into resolving arbitrary URLs, potentially exposing internal network resources. The immediate consequence is the ability for an attacker to read or interact with services that are otherwise unreachable from the external network, but the flaw does not grant arbitrary code execution or full system compromise.

Vendors product MITRE:Heimdall is affected for versions 2.11.6 through 2.13.x prior to the 2.14.0 release. No other versions or products are listed as impacted.

The CVSS score of 5.8 indicates a moderate impact. Because there is no EPSS score available and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is unclear. The attack vector is inferred to be remote HTTP access to the Tenable proxy endpoint; any user with network reach to the Heimdall instance could potentially leverage the flaw.