CVE-2026-30851

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-30851
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30851.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-30851
Aliases
Downstream
Related
Published
2026-03-07T16:28:37.097Z
Modified
2026-04-02T13:23:41.920019Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Details

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forwardauth copyheaders does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30851.json",
    "cwe_ids": [
        "CWE-287",
        "CWE-345"
    ]
}
References

Affected packages

Git / github.com/caddyserver/caddy

Affected ranges

Type
GIT
Repo
https://github.com/caddyserver/caddy
Events
Introduced
fb22a26b1a08a2fa3b2526d1852467904ee140f6
Fixed
ffb6ab0644f24c5ee6542aca6bd59b7a1b0a8f91
Database specific 
{
    "versions": [
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.11.2"
        }
    ]
}

Affected versions

v2.*
v2.10.0
v2.10.1
v2.10.2
v2.11.0
v2.11.0-beta.1
v2.11.0-beta.2
v2.11.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30851.json"

Git / github.com/mholt/caddy

Affected ranges

Type
GIT
Repo
https://github.com/mholt/caddy
Events
Introduced
fb22a26b1a08a2fa3b2526d1852467904ee140f6
Fixed
ffb6ab0644f24c5ee6542aca6bd59b7a1b0a8f91
Database specific 
{
    "versions": [
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.11.2"
        }
    ]
}

Affected versions

v2.*
v2.10.0
v2.10.1
v2.10.2
v2.11.0
v2.11.0-beta.1
v2.11.0-beta.2
v2.11.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30851.json"