8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52845

CVE-2026-52845: Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52845

CVE-2026-52845:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/caddyserver/caddy/v2	go	< 2.11.4	2.11.4
github.com/caddyserver/caddy	go	<= 1.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a header normalization bypass in Caddy's forward_auth and php_fastcgi handlers. An attacker can send a specially crafted HTTP request with a header containing an underscore (e.g., Remote_User). The serveHTTP function in modules/caddyhttp/server.go would incorrectly allow this header to pass through. The forward_auth handler, configured to copy a legitimate header like Remote-User, would delete the legitimate header but not the attacker's underscore-aliased version. When the request is later processed by php_fastcgi, the buildEnv function in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go normalizes all header names by replacing hyphens with underscores. This causes the attacker's header (Remote_User) and the legitimate header (Remote-User) to be mapped to the same environment variable (e.g., HTTP_REMOTE_USER), allowing the attacker to inject or override identity information in the backend PHP application. The patch addresses this by stripping any headers containing underscores at the beginning of the request processing in the serveHTTP function.

Vulnerable functions

Server.serveHTTP

modules/caddyhttp/server.go

This function is the entry point for handling HTTP requests in Caddy. The vulnerability existed because this function did not sanitize incoming headers. An attacker could send a header with an underscore in its name (e.g., `Remote_User`), which would be passed to downstream handlers. The patch fixes this by adding code to delete any header containing an underscore, preventing the malicious header from being processed.

Transport.buildEnv

modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go

This function is responsible for creating the environment variables for the FastCGI process. It uses `headerNameReplacer` to convert HTTP header names to CGI-style variable names. The vulnerability relies on the fact that this function normalizes headers by replacing hyphens with underscores. This allows an attacker-supplied header with an underscore (e.g., `Remote_User`) to collide with a legitimate header (e.g., `Remote-User`) after normalization, as both become `HTTP_REMOTE_USER`. While the primary fix was in `server.go`, this function's behavior is a critical component of the exploit chain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.