Github.Com Caddyserver Caddy V2 Modules Caddyhttp Reverseproxy vulnerabilities

1 known vulnerability affecting github.com/caddyserver_caddy_v2_modules_caddyhttp_reverseproxy.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1

Vulnerabilities

Page 1 of 1

CVE-2026-30851HIGH≥ 2.10.0, < 2.11.22026-03-06

CVE-2026-30851 [HIGH] CWE-287 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation ## Summary Caddy's `forward_auth` directive with `copy_headers` generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove o