CVE-2026-52845

Katalog CVE

CVSS 8.1 · High EPSS 0,45%

Kerentanan Improper Authentication pada caddyserver caddy. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-290: Authentication Bypass by Spoofing
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g exploit · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-52845
• https://bugzilla.redhat.com/show_bug.cgi?id=2491907
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json