PT-2026-23796

CVE-2026-30851

Published

2026-03-06

Updated

2026-10-01

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caddy versions 2.10.0 through 2.11.1

Description Caddy is a server platform that utilizes TLS by default. A flaw exists in the forward auth functionality where the copy headers option fails to remove headers provided by the client. This can lead to identity injection and potential privilege escalation. The vulnerable component is the copy headers function within the forward auth module.

Recommendations Update to Caddy version 2.11.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Nucleiav

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

CWE-287: Improper Authentication