Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-30851

29
FAUCET Score

CVE-2026-30851 affects Caddy server versions 2.10.0 through 2.11.1, where the forward_auth copy_headers feature fails to strip client-supplied headers. This oversight allows for identity injection and privilege escalation, posing a significant security risk. With a CVSS score of 8.1 (High), the vulnerability is network-exploitable with low attack complexity, potentially leading to high confidentiality and integrity impacts. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has received minimal community discussion, with only one mention.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.10.0, < 2.11.2CPE matchmatch criteria
cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.1HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.25%
Probability of exploitation in next 30 days
EPSS Percentile
16.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0025 is in the 5th percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

gopatch availablevia ghsa
Product: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxyFixed in: 2.11.2

Vendor Advisories (1)

goGHSA-7r4p-vjf4-gxv4high

Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Mar 6, 2026

References

github.com / caddyserver/caddy/issues/6610
Issue Tracking
github.com / caddyserver/caddy/pull/6608
Issue TrackingPatch
github.com / caddyserver/caddy/pull/7545
Issue TrackingPatch
github.com / caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4
ExploitMitigationPatchVendor Advisory