PT-2026-23796 · Caddy · Caddy

Nucleiav · CVE-2026-30851 · Published 2026-03-06 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caddy versions 2.10.0 through 2.11.1

Description Caddy is a server platform that utilizes TLS by default. A flaw exists in the forward auth functionality where the copy headers option fails to remove headers provided by the client. This can lead to identity injection and potential privilege escalation. The vulnerable component is the copy headers function within the forward auth module.

Recommendations Update to Caddy version 2.11.2 or later.

Exploit

Fix

LPE

Insufficient Verification of Data Authenticity

Improper Authentication

Weakness Enumeration

CWE-345

CWE-287

Related Identifiers

CVE-2026-30851

GHSA-7R4P-VJF4-GXV4

GO-2026-4639

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:1042-1

Affected Products

Caddy

References · 1755

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30851.json · Exploit
• https://github.com/caddyserver/caddy/pull/6608 · Patch
• https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4 · Vendor Advisory
• https://github.com/caddyserver/caddy/pull/7545 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30851 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30851 · Security Note
• https://ubuntu.com/security/CVE-2026-30851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7r4p-vjf4-gxv4 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30851 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-30851 · Security Note
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/issues/6610 · Note