CVE-2026-30851: Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-07 · updated 2026-06-17
Weakness: CWE-287

Description

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Affected products

caddyserver caddy: from 2.10.0 before 2.11.2 — fixed in 2.11.2

How to fix

Upgrade to a fixed version: caddyserver caddy 2.11.2. Check the vendor advisory for mitigations.

References

https://github.com/caddyserver/caddy/issues/6610
https://github.com/caddyserver/caddy/pull/6608
https://github.com/caddyserver/caddy/pull/7545
https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4

Get alerted when CVE-2026-30851 or the next vulnerability affects your stack