https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:10:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274994 EUVD-2026-274994 https://cve.radiocsirt.org/vuln/euvd-2026-274994 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30851 <p>Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.</p> <p>Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30851 https://cve.radiocsirt.org/vuln/ghsa-7r4p-vjf4-gxv4 <p><strong>Affected:</strong> Go: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy</p> <p>## Summary</p> <p>Caddy&#39;s `forward_auth` directive with `copy_headers` generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name.</p> <p>When an auth service returns `200 OK` without one of the configured `copy_headers` headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation.</p> <p>This is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected.</p> <p>---</p> <p>## Scope Argument</p> <p>This is a bug in the source code of this repository, not a misconfiguration.</p> <p>The operator uses `forward_auth` with `copy_headers` exactly as documented. The documentation contains no warning that client-supplied headers with the same names as `copy_headers` entries must also be stripped manually. The `forward_auth` directive is a security primitive whose stated purpose is to gate backend access behind an external auth service. A user of this directive reasonably expects that the backend cannot receive a client-controlled value for a header listed in `copy_headers`.</p> <p>The bug is traceable to a specific commit: PR #6608 (merged November 4, 2024), which added a `MatchNot` guard to skip the `Set` operation when the auth response header i…</p> <p><strong>Affected:</strong> Go: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy</p> <p>## Summary</p> <p>Caddy&#39;s `forward_auth` directive with `copy_headers` generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name.</p> <p>When an auth service returns `200 OK` without one of the configured `copy_headers` headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation.</p> <p>This is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected.</p> <p>---</p> <p>## Scope Argument</p> <p>This is a bug in the source code of this repository, not a misconfiguration.</p> <p>The operator uses `forward_auth` with `copy_headers` exactly as documented. The documentation contains no warning that client-supplied headers with the same names as `copy_headers` entries must also be stripped manually. The `forward_auth` directive is a security primitive whose stated purpose is to gate backend access behind an external auth service. A user of this directive reasonably expects that the backend cannot receive a client-controlled value for a header listed in `copy_headers`.</p> <p>The bug is traceable to a specific commit: PR #6608 (merged November 4, 2024), which added a `MatchNot` guard to skip the `Set` operation when the auth response header i…</p> https://cve.radiocsirt.org/vuln/ghsa-7r4p-vjf4-gxv4 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-30851 <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy</p> <p>Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.</p> <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy</p> <p>Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-30851