PT-2026-8042 · Caido · Caido

Bhavya32 · Publicado 2026-02-13 · Atualizado 2026-02-14 · CVE-2026-24853

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caido versions prior to 0.55.0

Description Caido is a web security auditing toolkit. Prior to version 0.55.0, the software blocks connections from non-whitelisted domains through the 8080 port, displaying a message indicating the Host/IP is not allowed to connect. This restriction can be bypassed by injecting an X-Forwarded-Host: 127.0.0.1:8080 header. This bypass can lead to remote code execution. The software attempts to block connections to the 8080 port, but this protection is circumvented by manipulating the X-Forwarded-Host header. All endpoints are affected.

Recommendations Update Caido to version 0.55.0 or later.

Exploit

Correção

RCE

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-24853

GHSA-3Q5Q-P8VJ-8783

Produtos afetados

Caido

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24853.json · Exploit
• https://github.com/caido/caido/security/advisories/GHSA-3q5q-p8vj-8783 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2022437748825522665 · Publicação no Twitter
• https://t.me/CVEtracker/44672 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24853 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24853 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2022453021926740108 · Publicação no Twitter
• https://t.me/cveNotify/152013 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2022499459502952477 · Publicação no Twitter