Insufficient verification of data authenticity in Caddy - CVE-2026-30851
Published: April 27, 2026
Vulnerability details
The vulnerability allows a remote user to inject trusted identity headers and escalate privileges.
The vulnerability exists due to insufficient verification of data authenticity in the forward_auth copy_headers handling in modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go when processing requests for which the upstream auth service returns 200 OK without one of the configured copy_headers headers. A remote user can send a specially crafted request with forged identity headers to inject trusted identity headers and escalate privileges.
Exploitation requires a valid authentication token, and affects deployments where the auth service validates credentials without returning the configured identity headers in its response.