Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
https://www.miggo.io/vulnerability-database/cve/CVE-2026-30851 这个漏洞有个模式： 1. 用户配置proxy，将auth server返回的x设置成header y传递给上游 2. 关键一步：auth server没有返回x，如果proxy不会清空header y，这时候传给上游的是client发过来的header y （1/2）
Post summary
The entry outlines the vulnerability scenario for CVE‑2026‑30851, explaining how a proxy can inadvertently forward a header that should be set by an authentication server, potentially exposing sensitive data.
🟠 CVE-2026-30851 - High Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing ident... https://www.thehackerwire.com/vulnerability/CVE-2026-30851/ https://t.co/wU7yY4MhQk
Post summary
The text announces a high‑severity CVE in Caddy, detailing improper header handling, but does not provide PoC, exploit, or patch information.
CVE-2026-30851 (CVSS:8.1, HIGH) is Analyzed. Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_a..https://nvd.nist.gov/vuln/detail/CVE-2026-30851 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
CVE‑2026‑30851 is highlighted with a CVSS score of 8.1, affecting Caddy versions 2.10.0 through 2.11.1; no exploitation or patch details are provided.
CVE-2026-30851 Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplie… https://www.cve.org/CVERecord?id=CVE-2026-30851
Post summary
The excerpt announces CVE-2026-30851, describing a flaw in Caddy's forward_auth copy_headers function affecting versions 2.10.0 through 2.11.2, but does not provide proof, exploitation details, or remediation guidance.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | caddyserver | caddy | - | - | - |