https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:42:38.693335+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-di50489 CLEANSTART-2026-DI50489 — Caddy is an extensible server platform that uses TLS by default 2026-10-03T05:42:38.877831+00:00

Affected: CleanStart: caddy

Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default.

 https://cve.radiocsirt.org/vuln/euvd-2026-337190 EUVD-2026-337190 2026-10-03T05:42:38.877899+00:00 EUVD-2026-337190 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52845 fkie_cve-2026-52845 2026-10-03T05:42:38.877922+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

 https://cve.radiocsirt.org/vuln/ghsa-f59h-q822-g45g GHSA-f59h-q822-g45g — Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` 2026-10-03T05:42:38.877961+00:00

Affected: Go: github.com/caddyserver/caddy/v2, Go: github.com/caddyserver/caddy

### Summary

`forward_auth copy_headers` deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through `php_fastcgi`, Caddy normalizes HTTP headers into CGI variables by replacing `-` with `_`.

This lets a client send an underscore alias that survives the `forward_auth` delete step but becomes the same PHP/FastCGI variable:

```text Remote-Groups -> HTTP_REMOTE_GROUPS Remote_Groups -> HTTP_REMOTE_GROUPS

Remote-User -> HTTP_REMOTE_USER Remote_User -> HTTP_REMOTE_USER ```

Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy.

### Details

`forward_auth copy_headers` intentionally removes client-controlled headers before setting values from the auth response:

- `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:212` - `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:222`

That delete is exact-field deletion through `http.Header.Del()`:

- `modules/caddyhttp/headers/headers.go:255` - `modules/caddyhttp/headers/headers.go:281`

So deleting `Remote-Groups` does not delete `Remote_Groups`.

Later, FastCGI exports all request headers into CGI variables:

- `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:410` - `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:414` - `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:510`

The normalizer replaces hyphens with underscores:

```go strings.NewReplace…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-52845 UBUNTU-CVE-2026-52845 2026-10-03T05:42:38.878057+00:00

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.