CVE-2026-46415: CWE-284: Improper Access Control in JasonLovesDoggo caddy-defender
CVE-2026-46415 is an improper access control vulnerability in the caddy-defender plugin for Caddy. Versions prior to 0.10.1 use the immediate peer IP address (RemoteAddr) instead of the resolved client IP when behind trusted proxies, allowing clients from blocked IP ranges to bypass IP-based blocking. This affects deployments using trusted proxies, CDNs, or load balancers. The issue is fixed in version 0.10.1 by using the resolved client IP when available. No complete workaround exists in affected versions except enforcing IP blocking at the proxy or edge layer. Deployments without intermediate proxies are not affected.
AI Analysis
Technical Summary
The caddy-defender plugin for Caddy prior to version 0.10.1 incorrectly uses the immediate peer's IP address (r.RemoteAddr) for request blocking decisions instead of the resolved client IP address provided by Caddy after applying trusted proxy policies. This causes IP-based blocking to be bypassed when Caddy is behind trusted proxies, CDNs, or load balancers, as the plugin blocks based on the proxy's IP rather than the original client IP. The vulnerability is fixed in version 0.10.1 by preferring the resolved client_ip request variable when available, falling back to RemoteAddr only if client_ip is not provided. There is no complete workaround in affected versions; users should enforce equivalent IP blocking at the trusted proxy or edge layer until upgrading. Deployments where Caddy receives traffic directly from clients are not affected.
Potential Impact
Clients from IP ranges that should be blocked can bypass caddy-defender's blocking when accessing Caddy through a trusted proxy, CDN, or load balancer because the plugin evaluates the proxy's IP instead of the original client IP. This leads to unauthorized access or evasion of IP-based restrictions. The vulnerability does not affect deployments without intermediate trusted proxies. The CVSS 3.1 score is 8.2 (High), indicating a network attack vector with low complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact and no availability impact.
Mitigation Recommendations
A fix is available in caddy-defender version 0.10.1, which correctly uses the resolved client IP for blocking decisions. Users should upgrade to version 0.10.1 or later to remediate this vulnerability. Until upgrading, affected deployments should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layers before traffic reaches Caddy. There is no complete workaround within affected caddy-defender versions for deployments relying on trusted proxy client IP resolution. Deployments without trusted proxies are not affected and require no action.
CVE-2026-46415: CWE-284: Improper Access Control in JasonLovesDoggo caddy-defender
Description
CVE-2026-46415 is an improper access control vulnerability in the caddy-defender plugin for Caddy. Versions prior to 0.10.1 use the immediate peer IP address (RemoteAddr) instead of the resolved client IP when behind trusted proxies, allowing clients from blocked IP ranges to bypass IP-based blocking. This affects deployments using trusted proxies, CDNs, or load balancers. The issue is fixed in version 0.10.1 by using the resolved client IP when available. No complete workaround exists in affected versions except enforcing IP blocking at the proxy or edge layer. Deployments without intermediate proxies are not affected.
CVSS v3.1
Score 8.2high
Affected software
pkg:github/jasonlovesdoggo/caddy-defenderRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The caddy-defender plugin for Caddy prior to version 0.10.1 incorrectly uses the immediate peer's IP address (r.RemoteAddr) for request blocking decisions instead of the resolved client IP address provided by Caddy after applying trusted proxy policies. This causes IP-based blocking to be bypassed when Caddy is behind trusted proxies, CDNs, or load balancers, as the plugin blocks based on the proxy's IP rather than the original client IP. The vulnerability is fixed in version 0.10.1 by preferring the resolved client_ip request variable when available, falling back to RemoteAddr only if client_ip is not provided. There is no complete workaround in affected versions; users should enforce equivalent IP blocking at the trusted proxy or edge layer until upgrading. Deployments where Caddy receives traffic directly from clients are not affected.
Potential Impact
Clients from IP ranges that should be blocked can bypass caddy-defender's blocking when accessing Caddy through a trusted proxy, CDN, or load balancer because the plugin evaluates the proxy's IP instead of the original client IP. This leads to unauthorized access or evasion of IP-based restrictions. The vulnerability does not affect deployments without intermediate trusted proxies. The CVSS 3.1 score is 8.2 (High), indicating a network attack vector with low complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact and no availability impact.
Mitigation Recommendations
A fix is available in caddy-defender version 0.10.1, which correctly uses the resolved client IP for blocking decisions. Users should upgrade to version 0.10.1 or later to remediate this vulnerability. Until upgrading, affected deployments should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layers before traffic reaches Caddy. There is no complete workaround within affected caddy-defender versions for deployments relying on trusted proxy client IP resolution. Deployments without trusted proxies are not affected and require no action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-13T21:04:10.933Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e3e5e2a4a8d5989464e38
Added to database: 07/20/2026, 15:27:26 UTC
Last enriched: 07/30/2026, 12:52:27 UTC
Last updated: 09/02/2026, 22:52:11 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.