Vulnetix
Try Vulnetix Request Demo
CVE-2026-30851 PUBLISHED CVSS 8.100000381469727 HIGH

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

EPSS 0.02% · 4.1th percentile

Risk Scores

CVSS v3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.02%
4.1th percentile

Affected Products

VendorProductVersions
caddyservercaddy>= 2.10.0, < 2.11.2, 2.10.0, *
github.comcaddyserver/caddy/v2/modules/caddyhttp/reverseproxy2.10.0, 2.10.0

Timeline

References

Open in Interactive Console →