CVE-2026-52845
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Caddy before version 2.11.4 has a vulnerability in the forward_auth copy_headers mechanism that allows a remote client to bypass identity header deletion and inject its own header into CGI/PHP-FastCGI. The issue arises from a difference in HTTP header normalization (replacing hyphens with underscores) between Caddy and PHP/FastCGI.
Risk Assessment
An attacker can impersonate an authenticated user or group, leading to unauthorized access to PHP/FastCGI applications behind Caddy. This can result in privilege escalation, data theft, or system integrity compromise.
Recommendation
Immediately upgrade Caddy to version 2.11.4 or later. If upgrading is not possible, temporarily disable the forward_auth copy_headers feature or apply WAF rules to block headers containing underscores.
Other vulnerabilities in Caddy
See all- CVE-2026-52846Medium
Caddy before version 2.11.4 has a vulnerability in the stripHTML template function that cannot reliably remove all HTML tags from input strings. Malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output.
- CVE-2026-52844High
Caddy before version 2.11.4 on Windows incorrectly handles path separators in path matchers, allowing bypass of access controls to protected directories. An unauthenticated remote attacker can access protected resources.
Original NVD description (English source)
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.