CVE-2026-52845: caddyserver caddy Improper Authentication

Vulnerability summary

CVE-2026-52845 is a high (CVSS 8.1) Improper Authentication vulnerability in caddyserver caddy. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-06-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.