Heimdall: Path received via Envoy gRPC corrupted when containing query string
Date: 2026-03
Affected: go/github.com/dadrus/heimdall
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-32811
CWE: CWE-116
CWE-863
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)

### Summary When using heimdall in envoy gRPC decision API mode, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypassed. The HTTP based decision API is NOT affected, and proxy mode is NOT affected either. **Note:** The issue can only lead to unintended access if heimdall is configured with an "allow all" default rule. Since v0.16.0, heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via `--insecure-skip-secure-default-rule-enforcement` or the broader `--insecure` flag. ### Details Envoy splits the requested URL into parts, and sends the parts individually to heimdall. Although `query` and `path` are present in the API, the `query` field is documented to be always empty and the URL query is included in the `path` field [1]. The implementation uses go's url library to reconstruct the url which automatically encodes special characters in the path. https://github.com/dadrus/heimdall/blob/1faba9e4160bd7ab3240cf6aa418e21bfef3401a/internal/handler/envoyextauth/grpcv3/request_context.go#L109-L115 As a consequence, a parameter like `/mypath?foo=bar` to `Path` is escaped into `/mypath%3Ffoo=bar`. Subsequently, a rule matching `/mypath` no longer matches and is bypassed. ### PoC Using the example docker compose setup, the `demo:public` rule is bypassed when adding a query parameter. > docker compose -f docker-compose-envoy-grpc.yaml -f docker-co


Mitigations:

Architectural layers (MAESTRO):