CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Remote attackers can bypass forward authentication checks by exploiting header normalization differences, allowing them to inject trusted identity headers into PHP/FastCGI applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52845?
CVE-2026-52845 is a high-severity authentication bypass vulnerability in caddyserver caddy, published on 23 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
Which versions are affected by CVE-2026-52845?
5 open source packages ship an affected version, including github.com/caddyserver/caddy/v2 and github.com/caddyserver/caddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy Go | All versions to 1.0.5 | None |
github.com/caddyserver/caddy Go | All versions to 1.0.5 | None |
Products include Caddyserver Caddy.
How do I fix CVE-2026-52845?
Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-52845 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52845 exists.
Other vulnerabilities in caddyserver caddy
- CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
- CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
- CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
- CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Sources
Also known as CLEANSTART-2026-DI50489, DEBIAN-CVE-2026-52845, GHSA-f59h-q822-g45g, GO-2026-5346, MINI-9236-f2jv-m5g5, MINI-9jhw-j2hq-p4vc and 1 more.