CVE-2026-42274
CVE-2026-42274 is a high-severity vulnerability with a CVSS 4.0 base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-35.
Key facts
- Severity: High (CVSS 4.0 base score 7.8)
- EPSS exploit prediction: 0% (29th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-28510
- Weakness: CWE-35
- Published:
- Last modified:
Description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
Frequently asked questions
- What is CVE-2026-42274?
- Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
- How severe is CVE-2026-42274?
- CVE-2026-42274 has a CVSS 4.0 base score of 7.8, rated high severity.
- Is CVE-2026-42274 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-42274?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-42274 have an EU (EUVD) identifier?
- Yes. CVE-2026-42274 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-28510.
- When was CVE-2026-42274 published?
- CVE-2026-42274 was published on 2026-05-08 and last updated on 2026-06-17.
References
- https://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a
- https://github.com/dadrus/heimdall/pull/3209
- https://github.com/dadrus/heimdall/releases/tag/v0.17.14
- https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq
Other CWE-35 vulnerabilities
- CVE-2025-59793 — Critical (CVSS 9.9): Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to…
- CVE-2026-6074 — Critical (CVSS 9.8): Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the…
- CVE-2025-41723 — Critical (CVSS 9.8): The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the…
- CVE-2025-42937 — Critical (CVSS 9.8): SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An…
- CVE-2025-30515 — Critical (CVSS 9.8): CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations…
- CVE-2026-52703 — Critical (CVSS 9.6): Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.