Riskcovery

CVE-2026-52845

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

State
Published
Severity
8.1 High
Published
Jun 23, 2026
Updated
Jul 15, 2026
Reserved
Jun 8, 2026

Read the record on cve.org

Description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NGitHub_M
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nredhat-SADP

Weaknesses

  • CWE-287 Improper Authentication
  • CWE-290 Authentication Bypass by Spoofing
  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Products

ProductVersions
caddycaddyserver
  • < 2.11.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.