Heimdall Dashboard is a widely used web application hub for personal and small-server environments. A recently discovered vulnerability (CVE-2025-50578) stems from improper handling of HTTP headers in the service, enabling host-header injection and open-redirect attacks.
This vulnerability is especially dangerous because it can be exploited by unauthenticated remote attackers and may already have been used in active attacks. All Heimdall users should immediately update to the latest version to mitigate potential data leakage and phishing risks.
Our Threat Analysis (TA) team is monitoring Heimdall web application vulnerabilities and will respond promptly to any new product issues.
1. Overview
Heimdall helps users centralize links to various services (e.g., Plex, Sonarr, Radarr, Nextcloud) running in Docker containers or on home networks, providing convenient access and management. This report summarizes analysis of CVE-2025-50578, a vulnerability found in the product.
Source : https://heimdall.site/
2. Attack Type
This vulnerability is caused by insufficient validation of HTTP request headers. An attacker can send a crafted X-Forwarded-Host or Referer header to induce Heimdall to perform malicious behaviors such as:
- Host Header Injection: When the application constructs internal links, resource URLs, or HTML content, an attacker-controlled domain (e.g., attacker.example) may be referenced. For example, email verification links or post-login redirect URLs generated by Heimdall could include the attacker’s domain.
- Example crafted request (host header injection):
GET /login HTTP/1.1
Host: your-legitimate-heimdall.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
X-Forwarded-Host: malicious-attacker.com
- Open Redirect: If the application uses the Referer header to return a user to their previous page, an attacker can insert a malicious URL in this header to force a redirect to an arbitrary site.
- Example crafted request (open redirect): ``` GET /settings HTTP/1.1 Host: your-legitimate-heimdall.com User-Agent: Mozilla/5.0 Accept-Language: en-US,en;q=0.5 Connection: close Referer: https://malicious-attacker.com/
3. Mitigation
LinuxServer.io has released a security patch to address CVE-2025-50578. Because this vulnerability is likely being actively exploited, Heimdall users must upgrade immediately.
- The fixed versions are 2.6.3-ls308 and later.
- If you use a Heimdall container, update to the latest image (e.g., linuxserver/heimdall:latest) or change any pinned version tags to 2.6.3-ls308 or newer.
Our AIWAF product team is currently performing further analysis on this vulnerability and plans to include protections in an upcoming pattern update.
4. Conclusion
Heimdall Dashboard is widely used in personal and small-server environments. CVE-2025-50578 arises from improper HTTP header handling and makes Heimdall vulnerable to host-header injection and open-redirect attacks. Because unauthenticated remote attackers can exploit this flaw, and given the possibility of active abuse, all Heimdall users should update to the latest version immediately to prevent data leakage and phishing threats.
Our TA team will continue to monitor Heimdall and respond swiftly to any newly discovered vulnerabilities.
