CVE-2026-52845
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Caddy before version 2.11.4 has a vulnerability in the forward_auth copy_headers mechanism that allows a remote client to bypass identity header deletion and inject its own header into CGI/PHP-FastCGI. The issue arises from a difference in HTTP header normalization (replacing hyphens with underscores) between Caddy and PHP/FastCGI.
Risk Assessment
An attacker can impersonate an authenticated user or group, leading to unauthorized access to PHP/FastCGI applications behind Caddy. This can result in privilege escalation, data theft, or system integrity compromise.
Recommendation
Immediately upgrade Caddy to version 2.11.4 or later. If upgrading is not possible, temporarily disable the forward_auth copy_headers feature or apply WAF rules to block headers containing underscores.
Other vulnerabilities in Caddy
See all- CVE-2026-92700Medium
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.
- CVE-2026-92284Medium
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.
- CVE-2026-77281Medium
Caddy in version 2.11.3 and earlier has three configuration-dependent weaknesses affecting the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
- CVE-2026-52846Medium
Caddy before version 2.11.4 has a vulnerability in the stripHTML template function that cannot reliably remove all HTML tags from input strings. Malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output.
- CVE-2026-52844High
Caddy before version 2.11.4 on Windows incorrectly handles path separators in path matchers, allowing bypass of access controls to protected directories. An unauthenticated remote attacker can access protected resources.
Original NVD description (English source)
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS