How severe is CVE-2026-30851?

CVE-2026-30851 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-30851 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-30851?

CVE-2026-30851 affects Caddyserver Caddy. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-30851?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-30851 have an EU (EUVD) identifier?

Yes. CVE-2026-30851 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-10176.

When was CVE-2026-30851 published?

CVE-2026-30851 was published on 2026-03-07 and last updated on 2026-06-17.

CVE-2026-30851

CVE-2026-30851 is a high-severity vulnerability in Caddyserver Caddy with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-10176
Weakness: CWE-287
Affected product: Caddyserver Caddy
Published: 2026-03-07
Last modified: 2026-06-17

Description

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Frequently asked questions

What is CVE-2026-30851?: Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.
How severe is CVE-2026-30851?: CVE-2026-30851 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-30851 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-30851?: CVE-2026-30851 affects Caddyserver Caddy. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-30851?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-30851 have an EU (EUVD) identifier?: Yes. CVE-2026-30851 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-10176.
When was CVE-2026-30851 published?: CVE-2026-30851 was published on 2026-03-07 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*

More vulnerabilities in Caddyserver Caddy

CVE-2026-27590 — Critical (CVSS 9.8): Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path…
CVE-2018-21246 — Critical (CVSS 9.8): Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the…
CVE-2026-27588 — Critical (CVSS 9.1): Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request…
CVE-2026-27587 — Critical (CVSS 9.1): Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request…
CVE-2026-27586 — Critical (CVSS 9.1): Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in…
CVE-2026-52845 — High (CVSS 8.1): Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the…

All CVEs affecting Caddyserver Caddy →

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-76658 — Critical (CVSS 10.0): A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an…
CVE-2026-76657 — Critical (CVSS 10.0): Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an…
CVE-2026-82695 — Critical (CVSS 10.0): A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file…
CVE-2026-82694 — Critical (CVSS 10.0): A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of…
CVE-2026-82693 — Critical (CVSS 10.0): A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the…
CVE-2026-78167 — Critical (CVSS 10.0): A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function…

Browse all CWE-287 (Improper Authentication) vulnerabilities →