Skip to content
OpenAdvisories

Package · Go

github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.1
    CVE-2026-30851

    Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

    Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched …

    caddyserver caddy github.com/caddyserver/caddy/v2 caddy Ubuntu Alpine Go