CVE-2026-52845

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52845", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-08T18:41:27.724Z", "datePublished": "2026-06-23T17:52:01.871Z", "dateUpdated": "2026-07-15T00:46:09.498Z"}, "containers": {"cna": {"title": "Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g"}], "affected": [{"vendor": "caddyserver", "product": "caddy", "versions": [{"version": "< 2.11.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T17:52:01.871Z"}, "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4."}], "source": {"advisory": "GHSA-f59h-q822-g45g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-24T14:25:18.472130Z", "id": "CVE-2026-52845", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T14:26:28.296Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "caddy", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}], "datePublic": "2026-06-23T17:52:01.871Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Caddy, an extensible server platform. A remote attacker can exploit a vulnerability in the `forward_auth` `copy_headers` functionality. This occurs because Caddy normalizes HTTP headers into Common Gateway Interface (CGI) variables by replacing hyphens with underscores, allowing a client to send an underscore alias that bypasses the header deletion step. This enables the remote attacker to inject or override identity and group headers trusted by PHP/FastCGI applications operating behind Caddy."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-52845"}, {"name": "RHBZ#2491907", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491907"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json"}], "timeline": [{"lang": "en", "time": "2026-06-23T19:02:21.968Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-23T17:52:01.871Z", "value": "Made public."}], "title": "github.com/caddyserver/caddy: Caddy: Remote client can inject or override identity headers via header normalization", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T00:46:09.498Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "github.com/caddyserver/caddy: Caddy: Remote client can inject or override identity headers via header normalization", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "caddy", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-23T19:02:21.968Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-23T17:52:01.871Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-06-23T17:52:01.871Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-52845", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491907", "name": "RHBZ#2491907", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Caddy, an extensible server platform. A remote attacker can exploit a vulnerability in the `forward_auth` `copy_headers` functionality. This occurs because Caddy normalizes HTTP headers into Common Gateway Interface (CGI) variables by replacing hyphens with underscores, allowing a client to send an underscore alias that bypasses the header deletion step. This enables the remote attacker to inject or override identity and group headers trusted by PHP/FastCGI applications operating behind Caddy."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T00:46:09.498Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52845", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T14:25:18.472130Z"}}}], "references": [{"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T14:26:00.572Z"}}], "cna": {"title": "Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`", "source": {"advisory": "GHSA-f59h-q822-g45g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "caddyserver", "product": "caddy", "versions": [{"status": "affected", "version": "< 2.11.4"}]}], "references": [{"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g", "name": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T17:52:01.871Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52845", "state": "PUBLISHED", "dateUpdated": "2026-07-15T00:46:09.498Z", "dateReserved": "2026-06-08T18:41:27.724Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-23T17:52:01.871Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "caddy", "vendor": "caddyserver", "versions": [{"status": "affected", "version": "< 2.11.4"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "caddy", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CC2FFA3-3F35-452A-A0B6-C1B66C0C73E6", "versionEndExcluding": "2.11.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4."}, {"lang": "es", "value": "Caddy es una plataforma de servidor extensible que usa TLS por defecto. Antes de la versi\u00f3n 2.11.4, forward_auth copy_headers elimina el encabezado de identidad exacto proporcionado por el cliente antes de copiar el valor de confianza desde la pasarela de autenticaci\u00f3n. Pero cuando la solicitud pasa m\u00e1s tarde por php_fastcgi, Caddy normaliza los encabezados HTTP en variables CGI reemplazando - por _. Esto permite a un cliente enviar un alias con guion bajo que sobrevive al paso de eliminaci\u00f3n de forward_auth pero se convierte en la misma variable PHP/FastCGI. Resultado: un cliente remoto puede inyectar o a veces sobrescribir encabezados de identidad/grupo confiados por aplicaciones PHP/FastCGI detr\u00e1s de Caddy. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.11.4."}], "id": "CVE-2026-52845", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52845", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-24T14:25:18.472130Z", "version": "2.0.3"}}]}, "published": "2026-06-23T18:18:05.267", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-52845"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491907"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-444"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-444"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/caddyserver/caddy: Caddy: Remote client can inject or override identity headers via header normalization", "id": "2491907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491907"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in Caddy, an extensible server platform. A remote attacker can exploit a vulnerability in the `forward_auth` `copy_headers` functionality. This occurs because Caddy normalizes HTTP headers into Common Gateway Interface (CGI) variables by replacing hyphens with underscores, allowing a client to send an underscore alias that bypasses the header deletion step. This enables the remote attacker to inject or override identity and group headers trusted by PHP/FastCGI applications operating behind Caddy."], "name": "CVE-2026-52845", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "caddy", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-06-23T17:52:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52845\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52845\nhttps://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "caddy", "source": "cna", "vendor": "caddyserver"}, "product": "caddy", "vendor": "caddyserver"}], "created": "2026-06-23T22:00:09.250556+00:00", "updated": "2026-06-24T10:30:14.689407+00:00", "vendors": ["caddyserver", "caddyserver$PRODUCT$caddy"]}