CVE-2026-30851 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-s…
High CVSS: 8.1

CVE-2026-30851

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.
Vendor
Caddyserver
Product
Caddy
CWE
CWE-287
Yayın Tarihi
2026-03-07 17:15:52
Güncelleme
2026-03-11 13:06:25
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-287 Caddy HIGH Caddyserver 2026

Referanslar

https://github.com/caddyserver/caddy/issues/6610 https://github.com/caddyserver/caddy/pull/6608 https://github.com/caddyserver/caddy/pull/7545 https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4