SB20261109223 - Multiple vulnerabilities in Caddy

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-52844)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to read protected static files in Windows Caddy deployments that enforce access restrictions through path matchers.

The vulnerability exists due to inconsistent backslash handling between Caddy path matchers and file_server on Windows when a request contains an encoded backslash. An unauthenticated remote attacker can request /private%5csecret.txt to bypass restrictions on /private/* and retrieve protected files within the configured site root.

2) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-52845)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged remote attacker to inject trusted identity or group values into PHP/FastCGI applications behind Caddy.

The vulnerability exists due to inconsistent header normalization between Caddy's forward_auth copy_headers filtering and subsequent FastCGI processing in deployments whose applications trust the resulting identity variables. A low-privileged remote attacker can send underscore-containing header aliases that survive filtering and become trusted CGI variables, including injecting a group value omitted by the authentication gateway.

3) Code Injection (CVE-ID: CVE-2026-77281)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to disclose Caddy process environment variables through rewritten request URLs.

The vulnerability exists due to repeated placeholder expansion in Caddy's rewrite handler when the configured rewrite URI incorporates request-controlled data and ends with a literal question mark. An unauthenticated remote attacker can inject environment-variable placeholders into a request header, causing their values to appear in the rewritten query string and become readable through a downstream handler that exposes it.

Remediation

Install update from vendor's website.

References

• https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6
• https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g
• https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9