CVE-2026-32811: 
NixOS vulnerability analysis and mitigation

CVE-2026-32811 is an authorization bypass vulnerability in Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service, caused by improper URL query string encoding in its Envoy gRPC decision API mode. It affects Heimdall versions 0.7.0-alpha through 0.17.10 (Go module github.com/dadrus/heimdall); the HTTP-based decision API and proxy mode are not affected. The vulnerability was disclosed on March 16, 2026, published to the GitHub Advisory Database on March 18, 2026, and assigned a CVSS v3.1 score of 8.2 (High) by GitHub and 7.5 (High) by NVD (GitHub Advisory, Heimdall Advisory).

The root cause is improper encoding/escaping of output (CWE-116) combined with incorrect authorization (CWE-863). Envoy's gRPC ExtAuth API always sends the full request target — including query string — in the path field, while the query field is documented as always empty. Heimdall's implementation in internal/handler/envoyextauth/grpcv3/request_context.go incorrectly assigned httpReq.GetPath() directly to Go's url.URL.Path field, causing Go's URL library to percent-encode the ? character, transforming /mypath?foo=bar into /mypath%3Ffoo=bar. As a result, any non-wildcard path rule matching /mypath no longer matches the encoded path and is silently bypassed (GitHub Advisory, Fix Commit). The fix parses the path field with url.ParseRequestURI() to correctly split the path and query components before constructing the internal URL (Fix PR).

Successful exploitation allows an unauthenticated remote attacker to bypass path-based access control rules enforced by Heimdall when operating in Envoy gRPC decision API mode. The primary impact is an integrity violation — specifically, unauthorized access to resources that should be blocked by specific path-matching rules. The vulnerability is only exploitable when Heimdall is configured with an "allow all" default rule (a deny-list model); since v0.16.0, Heimdall refuses to start with such a configuration unless explicitly overridden via --insecure-skip-secure-default-rule-enforcement or --insecure flags, significantly limiting the affected population (GitHub Advisory, Heimdall Advisory).

A proof-of-concept is publicly available in the official security advisory, demonstrating exploitation via simple curl commands against a Docker Compose-based Heimdall + Envoy deployment (Heimdall Advisory). No evidence of in-the-wild exploitation has been observed, and no threat actor attribution has been reported. The EPSS score is approximately 0.015–0.028% (low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication, no user interaction, and low attack complexity, but is conditional on the target being configured with an insecure allow-all default rule.

1. Reconnaissance: Identify Heimdall deployments running in Envoy gRPC ExtAuth mode (versions 0.7.0-alpha through 0.17.10) that are configured with an "allow all" default rule and have insecure enforcement disabled (e.g., started with --insecure or --insecure-skip-secure-default-rule-enforcement).
2. Identify protected paths: Probe the target to discover paths protected by specific non-wildcard Heimdall rules (e.g., /admin, /internal, /blocked-resource).
3. Craft bypass request: Append any arbitrary query parameter to the protected path, e.g., GET /blocked-resource?bypass or GET /admin?x=1. This causes Envoy to send /blocked-resource?bypass in the gRPC path field.
4. Trigger encoding bug: Heimdall receives the path, and Go's URL library encodes the ? as %3F, producing /blocked-resource%3Fbypass. The rule matching /blocked-resource no longer matches this encoded string.
5. Bypass access control: With no matching deny rule, the allow-all default rule applies and Heimdall grants access, forwarding the request to the upstream backend.

Example command: curl http://target:9090/protected-path?bypass (Heimdall Advisory).

• Network: HTTP requests to Envoy-proxied endpoints containing query parameters appended to paths that are normally accessed without query strings (e.g., GET /admin?x=1, GET /internal?bypass); unexpected 200 responses from paths that should return 401/403.
• Logs: Envoy access logs showing requests with query parameters to protected paths receiving upstream responses (HTTP 200) rather than auth rejections; Heimdall logs showing no rule match for paths containing %3F (percent-encoded question mark).
• Application Behavior: Repeated access to sensitive or administrative endpoints with arbitrary query parameters appended, particularly from unexpected source IPs or at unusual times (Heimdall Advisory).

Upgrade Heimdall to version 0.17.11 or later, which correctly parses the Envoy gRPC path field using url.ParseRequestURI() to properly separate path and query components (Fix Commit, GitHub Advisory). If immediate patching is not possible, ensure Heimdall is not configured with an "allow all" default rule — this eliminates the security impact entirely. Avoid using the --insecure-skip-secure-default-rule-enforcement or --insecure startup flags, as these override the secure-by-default enforcement introduced in v0.16.0. Note that the HTTP-based decision API and proxy mode are not affected and require no action.

The vulnerability was reported by community contributor "Kakadus" and promptly fixed by the Heimdall maintainer (dadrus) in a pull request merged on March 15, 2026, one day before the advisory was published (Fix PR). The Go vulnerability database (govulndb) tracked the issue as a potential Go vulnerability shortly after disclosure. An OpenSUSE security announcement was also issued referencing the govulncheck vulnerability database entry, indicating downstream Linux distribution awareness (GitHub Advisory).