CVE-2026-52845: Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
(updated )
forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _.
This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable:
Remote-Groups -> HTTP_REMOTE_GROUPS
Remote_Groups -> HTTP_REMOTE_GROUPS
Remote-User -> HTTP_REMOTE_USER
Remote_User -> HTTP_REMOTE_USER
Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy.
References
- access.redhat.com/security/cve/CVE-2026-52845
- bugzilla.redhat.com/show_bug.cgi?id=2491907
- github.com/advisories/GHSA-f59h-q822-g45g
- github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g
- nvd.nist.gov/vuln/detail/CVE-2026-52845
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52845.json
Code Behaviors & Features
Detect and mitigate CVE-2026-52845 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →