CVE-2026-52845: Caddy Header Injection Vulnerability in forward_auth and php_fastcgi

Technical summary

The vulnerability exploits a normalization inconsistency between Caddy's forward_auth module and its php_fastcgi handler. When forward_auth is configured with copy_headers, it removes the client-supplied identity header (e.g., 'X-User-ID') to prevent spoofing. However, an attacker can submit an underscore variant of that header (e.g., 'X_User_ID'). This underscore version is not deleted by forward_auth because its name differs from the hyphenated original. Subsequently, when the request enters the php_fastcgi pipeline, Caddy normalizes HTTP headers by replacing hyphens with underscores, causing 'X-User-ID' to become 'X_USER_ID' in CGI variables. The attacker's pre-submitted 'X_User_ID' header thus survives and collides with the trusted identity value, allowing injection or override. Affected CWEs include CWE-287 (Improper Authentication), CWE-290 (Authentication Using an Unsecured Channel), and CWE-444 (Inconsistent Interpretation of HTTP Requests).

Business impact

Organizations running Caddy with forward_auth and php_fastcgi are at risk of authentication bypass or privilege escalation. A malicious insider or network-adjacent attacker (with login credentials) could impersonate users, access restricted resources, or escalate to administrative functions within PHP applications. This is particularly dangerous for SaaS platforms, multi-tenant systems, and internal applications that rely on Caddy's header-based identity delegation. Blast radius depends on how strictly the downstream PHP applications validate identity headers, but in many setups those headers are treated as authoritative, making exploitation straightforward. Data theft, lateral movement, and compliance violations (unauthorized access logs) are likely consequences.

Affected systems

Caddy versions prior to 2.11.4 are vulnerable. The flaw only manifests when both forward_auth and php_fastcgi directives are active in the same configuration, and forward_auth must be configured to copy headers from the auth gateway. Standalone Caddy instances without PHP/FastCGI backend integration are not affected. Similarly, setups using only forward_auth without downstream FastCGI processing, or those not using header-based identity, face reduced or no risk. Users should verify their Caddyfile configuration to confirm presence of both forward_auth copy_headers and php_fastcgi directives.

Exploitability

Exploitation requires the attacker to have valid credentials to send an authenticated request (CVSS PR:L). No elevated privileges or user interaction are needed, and the attack is trivial to execute: simply append an underscore variant of the target identity header to a normal request. The attack surface is exposed over the network (AV:N) with no complex conditions (AC:L). Once exploited, the attacker gains the ability to read and modify protected resources, though not to cause denial of service. The overall CVSS 3.1 score of 8.1 (HIGH) reflects the high integrity and confidentiality impact coupled with low attack complexity.

Remediation

Upgrade Caddy to version 2.11.4 or later immediately. The patch corrects the header normalization logic to ensure that underscore variants of deleted headers are also removed before downstream processing. Organizations unable to upgrade immediately should consider disabling forward_auth copy_headers or removing php_fastcgi from configurations that handle sensitive identity, though this may break legitimate application functionality. An interim workaround is to configure a request matcher in Caddy to reject requests containing underscore variants of expected identity headers, but this requires knowing all variants and is error-prone.

Patch guidance

Download and deploy Caddy 2.11.4 or later from the official caddyserver.com releases page or your distribution's package repository. Test in a staging environment first to ensure no regressions in header handling or authentication flow. If using a containerized deployment, update your base image or Docker build to pull the patched version. Verify that forward_auth and php_fastcgi configurations continue to function correctly post-upgrade, particularly checking that legitimate identity headers are still properly copied and that unauthorized underscore variants are rejected. Rollback procedures should be documented in case of unexpected issues.

Detection guidance

Monitor access logs for anomalous requests containing underscore-variant headers that match known identity field names (e.g., 'X_User_ID', 'X_Auth_User'). Look for requests where the underscore variant is present but the hyphenated original is absent—this pattern is suspicious. Correlate with downstream PHP/FastCGI application logs to identify cases where an attacker's injected header overrode an expected identity value. Security Information and Event Management (SIEM) rules should flag authentication mismatches between Caddy's forward_auth audit log and the actual identity used by the PHP application. Network-based intrusion detection may be less effective here since the traffic is legitimate in form; focus on behavioral analysis of privilege escalation or unauthorized resource access post-exploitation.

Why prioritize this

This vulnerability merits immediate prioritization for organizations matching the affected profile. The combination of high CVSS (8.1), low attack complexity, and authenticated-attacker accessibility makes it a credible insider-threat vector. The flaw directly undermines authentication and authorization controls that many SaaS and enterprise platforms depend on. While the KEV program has not yet listed it (indicating lower exploit maturity in the wild at publish time), the simplicity of the attack and the sensitivity of identity headers ensure that exploit code and techniques will proliferate quickly. Patches are available and easy to deploy, so delay is unjustifiable.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (AV:N) network-accessible attack surface; (AC:L) no special conditions required; (PR:L) attacker must be authenticated but does not require admin rights; (UI:N) no user interaction needed; (S:U) impact is scoped to the vulnerable system alone; (C:H) high confidentiality impact via unauthorized data access; (I:H) high integrity impact via header injection; (A:N) no availability impact. The HIGH severity is appropriate because authentication bypass leading to unauthorized access and data modification are critical failures in any system, even if restricted to authenticated users. The score does not account for attack complexity in practice, which is minimal.

Frequently asked questions