Upstream information

CVE-2026-52845 at MITRE

Description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) CNA (GitHub)
Base Score 8.1 8.1
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network Network
Attack Complexity Low Low
Privileges Required Low Low
User Interaction None None
Scope Unchanged Unchanged
Confidentiality Impact High High
Integrity Impact High High
Availability Impact None None
CVSSv3 Version 3.1 3.1
No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)

SUSE Timeline for this CVE

CVE page created: Mon Aug 10 21:42:14 2026
CVE page last modified: Wed Oct 28 14:05:53 2026