Heimdall Data Database Proxy Vulnerable to Remote Code Execution via CRLF Injection
A CRLF injection vulnerability in Heimdall Data Database Proxy, tracked as CVE-2026-12357, allows authenticated remote attackers to execute arbitrary code with root privileges.
The Zero Day Initiative (ZDI) has disclosed a critical remote code execution vulnerability affecting Heimdall Data Database Proxy. The flaw, identified as CVE-2026-12357, resides within the generateFileContent function and stems from inadequate handling of Carriage Return Line Feed (CRLF) sequences.
This vulnerability requires an attacker to possess valid authentication credentials to be exploited. Once authenticated, an attacker can craft malicious input to inject CRLF characters, manipulating the proxy's behavior to achieve arbitrary code execution. The impact is severe, as the code can be executed with the privileges of the root user on the affected system, granting the attacker complete control.
Heimdall Data has addressed this vulnerability by releasing version build 25.03.01.24 of their Database Proxy. Users are strongly advised to update to this patched version to mitigate the risk. The release notes detailing this fix can be found on the Heimdall Data website.
The vulnerability was initially reported to the vendor on February 12, 2026. Following a coordinated disclosure process, the advisory was publicly released on July 23, 2026, with an update to the advisory also published on the same day. The research leading to the discovery of this flaw was conducted by Bobby Gould of TrendAI, working with the Zero Day Initiative.
While the vulnerability requires authentication, its potential for root-level code execution makes it a significant threat for any organization using Heimdall Data Database Proxy. Attackers who gain initial access to a system and obtain valid credentials could leverage this flaw for lateral movement or to establish persistence.
This discovery highlights the ongoing importance of secure coding practices, particularly in network-facing applications and proxies that handle user-supplied input. Proper sanitization and neutralization of special characters like CRLF are crucial to prevent injection-style attacks that can lead to severe security compromises.
Organizations utilizing Heimdall Data Database Proxy should prioritize applying the available security update. A thorough review of authenticated access controls and monitoring for any suspicious activity related to file content generation or command execution on affected systems is also recommended.