Bug 2491907 (CVE-2026-52845)

Summary:	CVE-2026-52845 github.com/caddyserver/caddy: Caddy: Remote client can inject or override identity headers via header normalization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abuckta, aprice, cmah, crizzo, dkuc, eshamard, gtanzill, jbuscemi, jdobes, jmitchel, jsamir, jsherril, jvasik, kaycoth, kgaikwad, kshier, mstipich, oezr, orabin, pbohmill, rblanco, rexwhite, rochandr, stcannon, sthirugn, teagle, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Caddy, an extensible server platform. A remote attacker can exploit a vulnerability in the `forward_auth` `copy_headers` functionality. This occurs because Caddy normalizes HTTP headers into Common Gateway Interface (CGI) variables by replacing hyphens with underscores, allowing a client to send an underscore alias that bypasses the header deletion step. This enables the remote attacker to inject or override identity and group headers trusted by PHP/FastCGI applications operating behind Caddy.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2492863, 2492864
Bug Blocks:

Description OSIDB Bzimport 2026-06-23 19:02:44 UTC

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.