Caddy Defender trusted proxy client IP bypass

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-46415 · Microsoft / collected KEV context

GHSA-3h23-rrpc-3p87

GO-2026-5086

cve-program · CVE-2026-46415

• https://github.com/JasonLovesDoggo/caddy-defender/security/advisories/GHSA-3h23-rrpc-3p87
• https://github.com/JasonLovesDoggo/caddy-defender/pull/139
• https://caddyserver.com/docs/caddyfile/matchers#client-ip
• https://caddyserver.com/docs/caddyfile/options#trusted-proxies

nvd · CVE-2026-46415

• https://caddyserver.com/docs/caddyfile/matchers#client-ip
• https://caddyserver.com/docs/caddyfile/options#trusted-proxies
• https://github.com/JasonLovesDoggo/caddy-defender/pull/139
• https://github.com/JasonLovesDoggo/caddy-defender/security/advisories/GHSA-3h23-rrpc-3p87

osv · GHSA-3h23-rrpc-3p87

• https://github.com/JasonLovesDoggo/caddy-defender/security/advisories/GHSA-3h23-rrpc-3p87
• https://github.com/JasonLovesDoggo/caddy-defender/pull/139
• https://github.com/JasonLovesDoggo/caddy-defender

osv · GO-2026-5086

• https://github.com/JasonLovesDoggo/caddy-defender/security/advisories/GHSA-3h23-rrpc-3p87
• https://github.com/JasonLovesDoggo/caddy-defender/pull/139

No related operational record is retained in the current change model.