← Back

CVE-2026-30851

nvd nist
Published: Mar 7, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Affected (1)

Products: Caddyserver: Caddy
Caddyserver
1 product
Caddy
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Caddy
From 2.10.0 to 2.11.2

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (4)

Source: security-advisories@github.com
Issue Tracking
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
ExploitMitigationPatchVendor Advisory

Timeline

No history available yet.