GHSA-7r4p-vjf4-gxv4: Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
SummaryCaddy's `forward_auth` directive with `copy_headers` generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name.When an auth service returns `200 OK` without one of the configured `copy_headers` headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation.This is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected.Scope ArgumentThis is a bug in the source code of this repository, not a misconfiguration.The operator uses `forward_auth` with `copy_headers` exactly as documented. The documentation contains no warning that client-supplied headers with the same names as `copy_headers` entries must also be stripped manually. The `forward_auth` directive is a security primitive whose stated purpose is to gate backend access behind an external auth service. A user of this directive reasonably expects that the backend cannot receive a client-controlled value for a header listed in `copy_headers`.The bug is traceable to a specific commit: PR #6608 (merged November 4, 2024), which added a `MatchNot` guard to skip the `Set` operation when the auth response header is absent. This change, while fixing a legitimate UX issue (headers being set to empty strings), removed the incidental protection that the previous unconditional `Set` provided. Before PR #6608, setting a header to an empty/unresolved placeholder overwrote the attacker-supplied value. After PR #6608, the attacker's value survives.The fix is a single-line code change in `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go`.Affected Versions| Version | Vulnerable |
|---|---|
| <= v2.9.x | No (old code overwrote client value with empty placeholder) |
| v2.10.0 (April 18, 2025) | Yes — first stable release containing PR #6608 |
| v2.10.1 | Yes |
| v2.10.2 | Yes |
| v2.11.0 | Yes |
| v2.11.1 (February 23, 2026, current) | Yes — unpatched |**Package:** `github.com/caddyserver/caddy/v2`
**Affected file:** `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go`Root CauseThe `parseCaddyfile` function builds one route per `copy_headers` entry. Each route uses a `MatchNot` guard and a `Set` operation:The route runs only when `{http.reverse_proxy.header.X-User-Id}` (the auth service's response header) is non-empty. When the auth service does not return `X-User-Id`, the placeholder is empty, the `MatchNot` guard fires, the route is skipped, and the original client-supplied `X-User-Id` header is never removed.There is no `Delete` operation anywhere in this function.Minimal Reproduction Config**Caddyfile** (no redactions, as required):Reproduction StepsNo containers, VMs, or external services are used. All services run as local processes.Step 1 — Start the auth serviceSave as `auth.py` and run `python3 auth.py` in a terminal:Step 2 — Start the backendSave as `backend.py` and run `python3 backend.py` in a second terminal:Step 3 — Start CaddyStep 4 — Run the three test cases**Test A: No token — must be blocked (confirms auth is enforced)**Expected: `HTTP/1.1 401`**Test B: Valid token, no injected headers (baseline)**Expected backend response:**Test C: ATTACK — valid token plus injected identity headers**Actual backend response (demonstrates the vulnerability):The backend receives the attacker-supplied identity values. The auth service accepted the token (correctly) but did not return `X-User-Id` or `X-User-Role`. Caddy skipped the `Set` operation due to the `MatchNot` guard but never deleted the original headers. The attacker-controlled values survived into the proxied request.**Test C is the proof of the vulnerability.**The attack requires only a valid (non-privileged) token. No admin account is needed.Full Debug LogRun Caddy with `debug` in the global block (included in the Caddyfile above). The relevant log lines from Test C will show:Note that no log line will show a header deletion because no deletion occurs. The `X-User-Id` and `X-User-Role` headers are never touched.ImpactAny deployment using `forward_auth` with `copy_headers` where the auth service validates credentials without returning identity headers in its response. This is common in:Stateless JWT validators (verify signature, no response headers)Session validators that leave identity decoding to the backendAuth services where only some requests return identity headersAttack:Attacker has any valid auth tokenAttacker sends request with forged `X-User-Id: admin` and `X-User-Role: superadmin`Auth service validates token, returns `200 OK`, no identity headersCaddy skips `Set` (placeholder empty), never deletes original headersBackend receives `X-User-Id: admin`, `X-User-Role: superadmin`Backend grants admin accessCVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` = **8.1 High**Working PatchThe `delete` route has no matcher, so it always runs. It fires before the existing `MatchNot + Set` route. The client-supplied header is cleared unconditionally. If the auth service provides the header, the subsequent `Set` then applies the correct value. If the auth service does not provide the header, the client's value is gone and the backend receives nothing.This is a minimal, targeted fix with no impact on existing functionality when the auth service returns the headers.Uniqueness ConfirmationThe following were checked and confirmed not to cover this vulnerability:All 6 GHSA advisories published 2026-02-23: GHSA-x76f-jf84-rqj8, GHSA-g7pc-pc7g-h8jh, GHSA-hffm-g8v7-wrv7, GHSA-879p-475x-rqh2, GHSA-4xrr-hq4w-6vf4, GHSA-5r3v-vc8m-m96gGitHub issue #7459 (malformed Host header)GitHub issue #6610 (template placeholder leakage in copy_headers — fixed by PR #6608, which introduced this regression)All Caddy community forum threads on `forward_auth`, `copy_headers`, and header strippingCVE-2026-25748 (authentik auth bypass — root cause is in authentik cookie parsing, not Caddy)CVE-2024-21494, CVE-2024-21499 (caddy-security third-party plugin, not Caddy core)PR #6608 comment thread (no security discussion)cvedetails.com Caddy product listing (no matching CVE)No prior report exists for this specific behavior.ReferencesVulnerable file (v2.11.1): https://github.com/caddyserver/caddy/blob/v2.11.1/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.goPR #6608 (introduced regression): https://github.com/caddyserver/caddy/pull/6608Issue #6610 (related UX bug, fixed by PR #6608): https://github.com/caddyserver/caddy/issues/6610forward_auth documentation: https://caddyserver.com/docs/caddyfile/directives/forward_authFixFix PR - https://github.com/caddyserver/caddy/pull/7545AI DisclosureAn LLM  was used to polish the report.
CVSS v3.1: 8.1