8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30851

CVE-2026-30851: Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30851

CVE-2026-30851:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy	go	>= 2.10.0, < 2.11.2	2.11.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the logic constructed within the parseCaddyfile function in modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go. This function is responsible for parsing the Caddyfile configuration for forward_auth and creating the corresponding HTTP handler routes.

The regressing commit 222a84fe7388755a8b877fb39c3f1a16b5545fe4 introduced a MatchNot guard to the header-copying logic. This guard prevents the Set operation from running if the authentication server's response header is empty. While this fixed a UX issue of headers being set to empty strings, it removed an incidental protection where the unconditional Set would overwrite any client-supplied header. The new logic did not include a corresponding Delete operation, so if the Set is skipped, the original client-supplied header remains.

The fixing commit 86b18fcd3c5c948072b227e7e7cf57f2ea1e0be1 rectifies this by explicitly adding a new route that performs an unconditional Delete on the header before the existing conditional Set route is processed. This ensures that any client-supplied header is always removed.

Therefore, the parseCaddyfile function is identified as the vulnerable function because it contains the flawed logic that generates the insecure runtime handler configuration, which is the root cause of the vulnerability.

Vulnerable functions

forwardauth.parseCaddyfile

modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go

This function is responsible for parsing the `forward_auth` directive from a Caddyfile and creating the necessary HTTP routes. The vulnerability stems from how this function constructs these routes. Specifically, it creates a route to copy headers from an authentication server's response to the request sent to the backend. However, it fails to first delete any existing headers with the same name that were supplied by the client. An attacker can exploit this by sending a request with a valid authentication token and forged identity headers (e.g., `X-User-Id: admin`). If the authentication server returns a 200 OK response but does not provide its own identity headers, the logic to overwrite them is skipped, and the attacker's forged headers are passed to the backend, leading to privilege escalation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.