CVE-2026-30851 - Vulnerability Analysis

Overview

Caddy 2.10.0 to < 2.11.2 contains a broken access control vulnerability caused by forward_auth copy_headers not stripping client-supplied headers, letting attackers perform identity injection and privilege escalation, exploit requires client to supply crafted headers.

Severity & Score

Impact

Attackers can escalate privileges by injecting identities via client-supplied headers, compromising access control.

Mitigation

Upgrade to version 2.11.2 or later.

References

• https://github.com/caddyserver/caddy/issues/6610
• https://github.com/caddyserver/caddy/pull/6608
• https://github.com/caddyserver/caddy/pull/7545
• https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 8, 2026

🟠 CVE-2026-30851 - High (8.1) Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has b... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30851/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner