PT-2026-23796 · Caddy · Caddy

Nucleiav · Published 2026-03-06 · Updated 2026-03-25 · CVE-2026-30851

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caddy versions 2.10.0 through 2.11.1

Description Caddy is a server platform that utilizes TLS by default. A flaw exists in the forward auth functionality where the copy headers option fails to remove headers provided by the client. This can lead to identity injection and potential privilege escalation. The vulnerable component is the copy headers function within the forward auth module.

Recommendations Update to Caddy version 2.11.2 or later.

Exploit

Fix

LPE

Improper Authentication

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-287

CWE-345

Related Identifiers

CVE-2026-30851

GHSA-7R4P-VJF4-GXV4

GO-2026-4639

SUSE-SU-2026:1042-1

Affected Products

Caddy

References · 144

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30851.json · Exploit
• https://github.com/caddyserver/caddy/pull/6608 · Patch
• https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4 · Vendor Advisory
• https://github.com/caddyserver/caddy/pull/7545 · Patch
• https://osv.dev/vulnerability/GO-2026-4639 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30851 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30851 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30851 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30851 · Security Note
• https://osv.dev/vulnerability/GHSA-7r4p-vjf4-gxv4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-30851 · Security Note
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/issues/6610 · Note
• https://suse.com/security/cve/CVE-2026-26998 · Note