{"action":"Upgrade github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy to 2.11.2 or later.","affected":[{"fixed":"2.11.2","introduced":"2.10.0"}],"component":"github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy","cve_ids":["CVE-2026-30851"],"ecosystem":"Go","epss":0.00368,"exploited":false,"fixed_versions":["2.11.2"],"ghsa_id":"GHSA-7r4p-vjf4-gxv4","id":"tcs_01M5KF2J2XGP1PQTF7CHA9Z2S3","modified_at":"2026-03-23T04:56:09.052625584Z","published_at":"2026-03-06T23:38:44Z","references":["https://osv.dev/vulnerability/GHSA-7r4p-vjf4-gxv4","https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4","https://nvd.nist.gov/vuln/detail/CVE-2026-30851","https://github.com/caddyserver/caddy/issues/6610","https://github.com/caddyserver/caddy/pull/6608","https://github.com/caddyserver/caddy/pull/7545","https://github.com/caddyserver/caddy"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-7r4p-vjf4-gxv4","url":"https://osv.dev/vulnerability/GHSA-7r4p-vjf4-gxv4"}],"summary":"Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation"}