CVE-2026-52845 Details
Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
A vulnerability exists in Caddy versions prior to 2.11.4, where the forward_auth copy_headers feature improperly handles client-supplied identity headers. The feature deletes the original identity header before copying a trusted value from the authentication gateway. However, when the request is processed through php_fastcgi, Caddy alters HTTP headers into CGI variables by replacing hyphens with underscores. This allows a remote client to send an underscore alias that bypasses the deletion and manipulates PHP/FastCGI variables, enabling injection or overwriting of identity or group headers in applications using Caddy as a reverse proxy.
Users should upgrade to Caddy version 2.11.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-52845 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2491907 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json | redhat-SADP | |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | redhat-SADP |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| caddyserver caddy | < 2.11.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |