CVE-2026-52845

{
  "id": "CVE-2026-52845",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T18:18:05.267",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4."
    },
    {
      "lang": "es",
      "value": "Caddy es una plataforma de servidor extensible que usa TLS por defecto. Antes de la versión 2.11.4, forward_auth copy_headers elimina el encabezado de identidad exacto proporcionado por el cliente antes de copiar el valor de confianza desde la pasarela de autenticación. Pero cuando la solicitud pasa más tarde por php_fastcgi, Caddy normaliza los encabezados HTTP en variables CGI reemplazando - por _. Esto permite a un cliente enviar un alias con guion bajo que sobrevive al paso de eliminación de forward_auth pero se convierte en la misma variable PHP/FastCGI. Resultado: un cliente remoto puede inyectar o a veces sobrescribir encabezados de identidad/grupo confiados por aplicaciones PHP/FastCGI detrás de Caddy. Esta vulnerabilidad está corregida en la versión 2.11.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "caddyserver",
          "product": "caddy",
          "versions": [
            {
              "version": "< 2.11.4",
              "status": "affected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "caddy",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T14:25:18.472130Z",
          "id": "CVE-2026-52845",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.11.4",
              "matchCriteriaId": "6CC2FFA3-3F35-452A-A0B6-C1B66C0C73E6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-52845",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491907",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}