CVE-2026-52845: Caddy Auth Bypass Vulnerability

CVE-2026-52845 Overview

CVE-2026-52845 is an authentication bypass vulnerability in Caddy, an extensible TLS-by-default server platform. Versions prior to 2.11.4 mishandle identity header sanitization when forward_auth and php_fastcgi directives are combined. The forward_auth copy_headers step deletes client-supplied identity headers before injecting trusted values from the authentication gateway. However, php_fastcgi later normalizes HTTP headers into CGI variables by replacing - with _. A client can submit an underscore-aliased header that survives the delete step yet collapses into the same FastCGI variable downstream. The flaw is tracked under CWE-287: Improper Authentication and is fixed in Caddy 2.11.4.

Critical Impact
Remote authenticated clients can inject or override identity and group headers trusted by PHP/FastCGI applications behind Caddy, leading to authentication bypass and privilege escalation.

Affected Products

Caddy server versions prior to 2.11.4
Deployments combining forward_auth with php_fastcgi directives
PHP/FastCGI applications relying on Caddy-supplied identity headers

Discovery Timeline

2026-06-23 - CVE-2026-52845 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52845

Vulnerability Analysis

The vulnerability arises from inconsistent header name handling between two Caddy directives. The forward_auth directive uses copy_headers to replace client-controlled identity headers with values asserted by the authentication gateway. To prevent header smuggling, Caddy first deletes the original client-supplied header. The deletion logic operates on the canonical HTTP header form, which preserves hyphens.

When the request continues to php_fastcgi, Caddy converts HTTP header names into CGI variables per the FastCGI specification. This conversion replaces hyphens with underscores and prepends HTTP_. A header named Remote-User and one named Remote_User both map to the FastCGI variable HTTP_REMOTE_USER. The deletion logic does not account for the underscore alias, so the attacker-supplied variant passes through.

The PHP application receives two values for the same superglobal entry, and the behavior depends on the order in which FastCGI processes them. The attacker can inject a controlled identity or override the gateway-asserted value.

Root Cause

The root cause is asymmetric header normalization between forward_auth and php_fastcgi. The auth layer treats - and _ as distinct characters, while the FastCGI layer treats them as equivalent. This violates trust boundary assumptions between the two pipeline stages.

Attack Vector

An attacker sends an HTTP request through Caddy containing a forged identity header that uses underscores instead of hyphens, such as Remote_User: admin instead of Remote-User: admin. The forward_auth directive deletes only the hyphenated canonical form. The underscored variant reaches php_fastcgi, which normalizes it into the same CGI variable the application trusts for authentication. The PHP application reads the injected identity and grants access without further validation. Attack complexity is low and the attacker requires only network access plus low privileges to reach the protected endpoint.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-f59h-q822-g45g for vendor technical details.

Detection Methods for CVE-2026-52845

Indicators of Compromise

HTTP requests containing identity headers with underscore characters such as Remote_User, X_Forwarded_User, or X_Auth_Groups reaching Caddy endpoints fronting PHP applications.
Access log entries where an authenticated session appears for a user that did not complete the upstream forward_auth handshake.
PHP application logs showing privileged actions performed under identities not present in the authentication gateway audit trail.

Detection Strategies

Inspect Caddy access logs for inbound requests carrying header names that contain underscores in the identity namespace used by the FastCGI backend.
Correlate authentication gateway logs with PHP application session creation events to detect identities that bypass the auth provider.
Deploy a web application firewall rule that rejects or normalizes request headers containing underscores before they reach Caddy.

Monitoring Recommendations

Enable verbose request logging on Caddy with the full set of inbound headers captured for endpoints handled by php_fastcgi.
Alert on the Caddy version string in deployments to confirm all hosts run 2.11.4 or later.
Monitor PHP-FPM access patterns for sudden changes in the distribution of HTTP_REMOTE_USER or equivalent identity variables.

How to Mitigate CVE-2026-52845

Immediate Actions Required

Upgrade Caddy to version 2.11.4 or later on every host running both forward_auth and php_fastcgi directives.
Audit Caddyfile configurations to identify any pipeline that combines authentication forwarding with PHP-FastCGI handling.
Review PHP application access logs for the period preceding the upgrade to identify potential exploitation.

Patch Information

The maintainers fixed this issue in Caddy 2.11.4. The patch aligns header deletion with FastCGI normalization so that underscore aliases of identity headers are stripped alongside their hyphenated counterparts. Refer to the GitHub Security Advisory GHSA-f59h-q822-g45g for the full vendor advisory and patch references.

Workarounds

Place a reverse proxy or WAF in front of Caddy that rejects HTTP headers containing underscore characters in identity-related names.
Configure the PHP application to validate identity claims against a signed token from the auth gateway rather than trusting raw FastCGI variables.
Explicitly enumerate and unset underscore-aliased identity variables in the FastCGI handler configuration until the upgrade is complete.

bash

# Verify the installed Caddy version is patched
caddy version
# Expect: v2.11.4 or later