TI-2026-23680 Aliases CVE-2026-30851 GHSA-7r4p-vjf4-gxv4

Improper authentication in caddyserver caddy

HIGH 73CWE-287Published 2026-03-07 · Updated 2026-03-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00285 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed caddy (caddyserver): 2.11.2github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy (Go): 2.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
caddyserver	caddy	2.10.0 to before 2.11.2	2.11.2	Patch available	CNA
—	github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy (Go)	2.10.0 to before 2.11.2	2.11.2	Patch available	GHSA-7r4p-vjf4-gxv4

caddy Vendorcaddyserver Affected 2.10.0 to before 2.11.2 Fixed in 2.11.2 Patch available CNA
github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy (Go) Vendor— Affected 2.10.0 to before 2.11.2 Fixed in 2.11.2 Patch available GHSA-7r4p-vjf4-gxv4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:caddyserver:caddy::::::::	2.10.0 to before 2.11.2	Vulnerable	caddyserver

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions 2.10.0 to before 2.11.2 Vulnerable ·caddyserver

Remediation

Fix · CNA caddy (caddyserver) Fixed in 2.11.2
Fix · GHSA-7r4p-vjf4-gxv4 github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy (Go) Fixed in 2.11.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-30851
2026-10-03 Alias added: GHSA-7r4p-vjf4-gxv4

References

Exploit 1

https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-30851

Other 2

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7
TI-2026-37952 Caddy: Windows `file_server` path authorization bypass via encoded backslash CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences