{"id":"CVE-2026-46415","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T16:17:01.163","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value. As a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP. The issue is fixed in version 0.10.1 by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP. There is no complete workaround in affected Defender versions for deployments that rely on Caddy's trusted proxy client IP resolution. Until upgrading, affected users should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layer before traffic reaches Caddy. Deployments where Caddy receives traffic directly from clients, without an intermediate trusted proxy, are not affected by this bypass."},{"lang":"es","value":"El plugin Caddy Defender es un middleware para Caddy que permite a los usuarios bloquear o manipular solicitudes basándose en la dirección IP del cliente. Antes de la versión 0.10.1, Caddy Defender utilizaba “r.RemoteAddr” al evaluar si una solicitud debía ser bloqueada. “RemoteAddr” es la dirección del par inmediato conectado a Caddy. En implementaciones donde Caddy está detrás de un proxy de confianza, CDN o balanceador de carga, el par inmediato suele ser el proxy, no el cliente original. Caddy resuelve la dirección del cliente original en su variable de solicitud “client_ip” después de aplicar la política “trusted_proxies” configurada, pero Defender no utilizaba ese valor. Como resultado, los clientes de rangos de dirección IP bloqueados podían eludir a Defender al acceder a Caddy a través de un proxy de confianza cuya propia dirección IP no estaba bloqueada. Esto afecta a las implementaciones que utilizan Defender detrás de proxies de confianza y esperan que aplique el bloqueo basándose en la dirección IP real del cliente. El problema se soluciona en la versión 0.10.1 haciendo que Defender prefiera la variable de solicitud “client_ip” resuelta de Caddy cuando esté disponible. Defender recurre a “RemoteAddr” solo cuando Caddy no ha proporcionado una dirección IP de cliente resuelta. No existe una solución alternativa completa en las versiones afectadas de Defender para implementaciones que dependen de la resolución de la dirección IP del cliente por parte del proxy de confianza de Caddy. Hasta la actualización, los usuarios afectados deben aplicar un bloqueo de dirección IP equivalente en el proxy de confianza, CDN, balanceador de carga, cortafuegos u otra capa perimetral antes de que el tráfico llegue a Caddy. Las implementaciones donde Caddy recibe tráfico directamente de los clientes, sin un proxy de confianza intermedio, no se ven afectadas por esta elusión."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"JasonLovesDoggo","product":"caddy-defender","versions":[{"version":"< 0.10.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-21T13:52:55.935258Z","id":"CVE-2026-46415","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://caddyserver.com/docs/caddyfile/matchers#client-ip","source":"security-advisories@github.com"},{"url":"https://caddyserver.com/docs/caddyfile/options#trusted-proxies","source":"security-advisories@github.com"},{"url":"https://github.com/JasonLovesDoggo/caddy-defender/pull/139","source":"security-advisories@github.com"},{"url":"https://github.com/JasonLovesDoggo/caddy-defender/security/advisories/GHSA-3h23-rrpc-3p87","source":"security-advisories@github.com"}]}