CVE-2026-52845: CWE-287: Improper Authentication in caddyserver caddy
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
AI Analysis
Technical Summary
Caddyserver caddy versions before 2.11.4 have a vulnerability in the forward_auth copy_headers feature. The module deletes the exact client-supplied identity header before copying a trusted value from the authentication gateway. However, because Caddy normalizes HTTP headers by replacing hyphens with underscores when converting them into CGI variables for PHP/FastCGI, a client can send an underscore variant of the header that bypasses the deletion step. This allows a remote attacker to inject or override identity or group headers trusted by PHP/FastCGI applications behind Caddy. The vulnerability is addressed in version 2.11.4.
Potential Impact
An attacker can remotely inject or override identity and group headers that PHP/FastCGI applications trust, potentially leading to unauthorized access or privilege escalation. The vulnerability affects confidentiality and integrity of authentication data but does not impact availability. The CVSS score is 8.1 (high severity), indicating a significant risk if exploited.
Mitigation Recommendations
This vulnerability is fixed in caddyserver caddy version 2.11.4. Users should upgrade to version 2.11.4 or later to remediate this issue. No other vendor advisories indicate alternative mitigations or that no action is required. Patch status is confirmed by the vendor advisory. There is no indication that this is a cloud service; thus, manual upgrade is required.
CVE-2026-52845: CWE-287: Improper Authentication in caddyserver caddy
Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
CVSS v3.1
Score 8.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Caddyserver caddy versions before 2.11.4 have a vulnerability in the forward_auth copy_headers feature. The module deletes the exact client-supplied identity header before copying a trusted value from the authentication gateway. However, because Caddy normalizes HTTP headers by replacing hyphens with underscores when converting them into CGI variables for PHP/FastCGI, a client can send an underscore variant of the header that bypasses the deletion step. This allows a remote attacker to inject or override identity or group headers trusted by PHP/FastCGI applications behind Caddy. The vulnerability is addressed in version 2.11.4.
Potential Impact
An attacker can remotely inject or override identity and group headers that PHP/FastCGI applications trust, potentially leading to unauthorized access or privilege escalation. The vulnerability affects confidentiality and integrity of authentication data but does not impact availability. The CVSS score is 8.1 (high severity), indicating a significant risk if exploited.
Mitigation Recommendations
This vulnerability is fixed in caddyserver caddy version 2.11.4. Users should upgrade to version 2.11.4 or later to remediate this issue. No other vendor advisories indicate alternative mitigations or that no action is required. Patch status is confirmed by the vendor advisory. There is no indication that this is a cloud service; thus, manual upgrade is required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T18:41:27.724Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-52845","vendor":"Red Hat"}]
Threat ID: 6a3acbe4eed863c81e6c9a54
Added to database: 06/23/2026, 18:09:40 UTC
Last enriched: 07/15/2026, 09:30:19 UTC
Last updated: 08/07/2026, 05:53:27 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.