PT-2026-42048

Name of the Vulnerable Software and Affected Versions Caddy Defender versions prior to 0.10.1 Description The software incorrectly used r.RemoteAddr to evaluate whether a request should be blocked. In environments where Caddy is positioned behind a trusted proxy, CDN, or load balancer, RemoteAddr...

GHSA-M675-2P33-XV9G Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Summary The FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treatin...

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Summary The FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treatin...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity through improper handling of Unicode characters in the splitPos function. An attacker can execute arbitrary code by uploading a file with a specially crafted name containing non-ASCII bytes or Unico...

CVE-2026-45135

creationtimestamp| type| source ---|---|--- 2026-05-13 14:39:28+00:00| published-proof-of-concept| https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g 2026-06-23 20:06:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy77x3pn325...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: caddy: caddy-2.11.3-0.1.hum1 aarch64, x8664 caddy-2.11.3-0.1.hum1.src src...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: openbao-fips, seaweedfs, grafana-alloy, juicefs, openfga, commercial-expanso-edge, gitlab-kas, cerbos, splunk-otel-collector, gotrue, azure-service-operator-fips, temporal-fips, grafana-alloy-fips, keda-fips, gitlab-kas-fips, bento-fips, cloudnative-pg-fips,...

Improper Certificate Validation

Caddy is vulnerable to Improper Certificate Validation. The vulnerability is due to swallowed errors in ClientAuthentication.provision, where failures loading trustedcacertfile or trustedcacertspemfiles are ignored, causing mTLS authentication to fail open and accept any client certificate signed...

Improper Access Control

Caddy is vulnerable to Improper Access Control. The vulnerability is due to incorrect case-insensitive matching in the HTTP path request matcher when percent-encoded sequences are present, allowing attackers to alter request path casing and bypass path-based routing or attached access controls...

Improper Access Control

Caddy is vulnerable to Improper Access Control. The vulnerability is due to incorrect case-insensitive matching in the HTTP host request matcher when large host lists are configured, allowing attackers to modify the casing of the Host header and bypass host-based routing or associated access...

BIT-AUTHENTIK-2026-25748 authentik has a forward authentication bypass with broken cookie

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious...

CVE-2026-30836 vulnerabilities

Vulnerabilities for packages: caddy...

GHSA-Q4R8-XM5F-56GW vulnerabilities

Vulnerabilities for packages: caddy...

GHSA-Q4R8-XM5F-56GW vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, frankenphp-8.4, frankenphp-8.5, step-ca-fips, step-issuer-fips, frankenphp-8.2, caddy, caddy-fips...

CVE-2026-30836 vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, frankenphp-8.4, frankenphp-8.5, step-ca-fips, step-issuer-fips, frankenphp-8.2, caddy, caddy-fips...

GO-2026-4644 Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

Caddy's varsregexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy...

GO-2026-4639 Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

Caddy forwardauth copyheaders Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation in github.com/caddyserver/caddy...

SUSE CVE-2026-30851

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forwardauth copyheaders does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2...

SUSE CVE-2026-30852

Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the varsregexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When varsregexp matches against a placeholder like http.request.header.X-Input, the...

Linux Distros Unpatched Vulnerability : CVE-2026-30852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the varsregexp matcher in vars.go:337 double-expan...