TI-2026-37953 Aliases CVE-2026-52845 GHSA-f59h-q822-g45g

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

HIGH 70CWE-287Published 2026-06-23 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00445 38th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed caddy (caddyserver): 2.11.4github.com/caddyserver/caddy/v2 (Go): 2.11.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
caddyserver	caddy	before 2.11.4	2.11.4	Patch available	CNA
—	github.com/caddyserver/caddy/v2 (Go)	before 2.11.4	2.11.4	Patch available	GHSA-f59h-q822-g45g
—	github.com/caddyserver/caddy (Go)	up to 1.0.5	—	No fix listed	GHSA-f59h-q822-g45g

caddy Vendorcaddyserver Affected before 2.11.4 Fixed in 2.11.4 Patch available CNA
github.com/caddyserver/caddy/v2 (Go) Vendor— Affected before 2.11.4 Fixed in 2.11.4 Patch available GHSA-f59h-q822-g45g
github.com/caddyserver/caddy (Go) Vendor— Affected up to 1.0.5 Fixed in — No fix listed GHSA-f59h-q822-g45g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:caddyserver:caddy::::::::	before 2.11.4	Vulnerable	caddyserver

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions before 2.11.4 Vulnerable ·caddyserver

Remediation

Fix · CNA caddy (caddyserver) Fixed in 2.11.4
Fix · GHSA-f59h-q822-g45g github.com/caddyserver/caddy/v2 (Go) Fixed in 2.11.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-52845
2026-10-03 Alias added: GHSA-f59h-q822-g45g

References

Exploit 1

https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-52845

Other 4

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences