High, CVSS 8.1GoPublished
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
CVE-2026-30851 · GHSA-7r4p-vjf4-gxv4
- Affected
- Go github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy >= 2.10.0, < 2.11.2
- Fixed in
- 2.11.2· Vendor fix available
- Issue
- Caddy's forwardauth directive with copyheaders generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name. When an auth service returns 200 OK without one of the configured copyheaders headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation. This is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected. --- Scope Argument This is a bug in the source code of this repository, not a misconfiguration. The operator uses forwardauth with copyheaders exactly as documented. The documentation contains no warning that client-supplied headers with the same names as copyheaders entries must…
Recommended action: Upgrade to 2.11.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.