Product

caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy vulnerabilities

1 published CVE affecting caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 1
Medium: 0
Low: 0
Unscored: 0
CISA KEV: 0

Latest caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy CVEs

Newest publication first

CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Published 2026-03-07

HighCVSS 8.8

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy vulnerabilities

Latest caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy CVEs

CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation