{"id":"EUVD-2026-38558","enisaUuid":"aeb6a681-521c-334b-8525-fb43c4907d8e","description":"Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.","datePublished":"Jun 23, 2026, 5:52:01 PM","dateUpdated":"Jul 15, 2026, 12:46:09 AM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g\n","aliases":"CVE-2026-52845\nGHSA-f59h-q822-g45g\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"3df12ca9-3735-3000-ad81-0c37d16439b5","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"\u003c 2.11.4"}],"enisaIdVendor":[{"id":"6fa70fbf-9946-3d4e-a397-82c034485ed7","vendor":{"name":"caddyserver"}}],"enisaIdVulnerability":[{"id":"42584014-86af-307e-a803-d17e18e8b4fe","vulnerability":{"id":"CVE-2026-52845","description":"Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.","datePublished":"Jun 23, 2026, 5:52:01 PM","dateUpdated":"Jul 15, 2026, 12:46:09 AM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g\n","enisa_id":"EUVD-2026-38558\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 7, 2026, 7:19:49 AM","vulnerabilityProduct":[{"id":"5b8ffff0-43a7-3539-9d81-1f7eafffef5b","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"\u003c 2.11.4"}],"vulnerabilityVendor":[{"id":"3c83d2ec-693e-31be-8c0f-db050d658cce","vendor":{"name":"caddyserver"}}]}},{"id":"992e4db5-20ae-34bb-a816-c72c441453ac","vulnerability":{"id":"GHSA-f59h-q822-g45g","description":"Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`","datePublished":"Jun 16, 2026, 9:28:28 PM","dateUpdated":"Jul 20, 2026, 9:02:48 PM","baseScore":0.0,"references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52845\nhttps://access.redhat.com/security/cve/CVE-2026-52845\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2491907\nhttps://github.com/caddyserver/caddy\nhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json\n","enisa_id":"EUVD-2026-38558\n","aliases":"CVE-2026-52845\nGHSA-f59h-q822-g45g\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}