https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:14:29.965814+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274994 EUVD-2026-274994 2026-10-04T02:14:29.968595+00:00 EUVD-2026-274994 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30851 fkie_cve-2026-30851 2026-10-04T02:14:29.968625+00:00

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

 https://cve.radiocsirt.org/vuln/ghsa-7r4p-vjf4-gxv4 GHSA-7r4p-vjf4-gxv4 — Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escal… 2026-10-04T02:14:29.968655+00:00

Affected: Go: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy

## Summary

Caddy's `forward_auth` directive with `copy_headers` generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name.

When an auth service returns `200 OK` without one of the configured `copy_headers` headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation.

This is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected.

---

## Scope Argument

This is a bug in the source code of this repository, not a misconfiguration.

The operator uses `forward_auth` with `copy_headers` exactly as documented. The documentation contains no warning that client-supplied headers with the same names as `copy_headers` entries must also be stripped manually. The `forward_auth` directive is a security primitive whose stated purpose is to gate backend access behind an external auth service. A user of this directive reasonably expects that the backend cannot receive a client-controlled value for a header listed in `copy_headers`.

The bug is traceable to a specific commit: PR #6608 (merged November 4, 2024), which added a `MatchNot` guard to skip the `Set` operation when the auth response header i…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-30851 UBUNTU-CVE-2026-30851 2026-10-04T02:14:29.968743+00:00

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.