GHSA-WWHQ-W58M-W29C Caddy CVE-2026-30852 Fix Bypass

TL;DR CVE-2026-30852 fixed double expansion in varsregexp when the variable key is a placeholder e.g. http.vars.x. The fix does NOT protect literal key names e.g. tenantid. An attacker injects env.AWSSECRETACCESSKEY or file./etc/passwd via a request header → Caddy expands it on the second pass →...

CVE-2026-30852

creationtimestamp| type| source ---|---|--- 2026-03-06 01:59:32+00:00| published-proof-of-concept| https://github.com/caddyserver/caddy/security/advisories/GHSA-m2w3-8f23-hxxf 2026-03-07 20:08:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgimye6fdo27...