Insufficient verification of data authenticity in Caddy - CVE-2026-30851

Detailed vulnerability description

The vulnerability allows a remote user to inject trusted identity headers and escalate privileges.

The vulnerability exists due to insufficient verification of data authenticity in the forward_auth copy_headers handling in modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go when processing requests for which the upstream auth service returns 200 OK without one of the configured copy_headers headers. A remote user can send a specially crafted request with forged identity headers to inject trusted identity headers and escalate privileges.

Exploitation requires a valid authentication token, and affects deployments where the auth service validates credentials without returning the configured identity headers in its response.

How to mitigate CVE-2026-30851

Sources

• https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4
• https://github.com/advisories/GHSA-7r4p-vjf4-gxv4