Caddy Security Update DSA-6429-1: What Self-Hosted Operators Need to Check

Debian Security Advisory DSA-6429-1, published August 10–11 2026, covers eight CVEs in Caddy: two rated 9.x Critical, one High, and five Medium. If you run Caddy on Debian Trixie, upgrade to 2.6.2-12+deb13u1. If you run upstream Caddy from the official repository or Docker, you need 2.11.4. Before you do, check whether you pass any underscore-named request headers through Caddy — the fix for the most impactful auth vulnerability drops those headers silently and without an opt-out.

What is in DSA-6429-1?

Eight CVEs across access-control bypass, FastCGI path confusion, admin API weaknesses, and a template XSS flaw:

Sources: Tenable plugin 334443 (Debian DSA-6429-1), NVD, OpenCVE, GitHub Security Advisories.

Which CVEs affect your deployment

The right question is not “which CVEs exist” but “which ones apply to my configuration.” Caddy is commonly used in three configurations on small servers:

Caddy as a reverse proxy (no PHP, no FastCGI)

CVE-2026-27590 (FastCGI path confusion) and CVE-2026-52845 (forward_auth FastCGI identity injection) do not apply if you are not using php_fastcgi. CVE-2026-27588 (host matcher bypass) only triggers with more than 100 entries in a single host matcher directive — rare on small self-hosted setups. The admin API issues (CVE-2026-27589, CVE-2026-45692) apply if the admin API is running and accessible, which is the default on localhost:2019. Still update: the CSRF risk is real on machines where a browser is also used.

Caddy as a reverse proxy with forward_auth (Authelia, Authentik, Gitea remote_user guard)

CVE-2026-52845 is directly relevant if you use forward_auth with copy_headers to pass identity or group headers to a PHP/FastCGI backend. A remote client can send a header with underscores in the name — for example, Remote_Groups: admin — that survives the forward_auth delete step because http.Header.Del() is exact-field only. When Caddy later exports headers to FastCGI, it normalises hyphens and underscores into the same CGI variable name (HTTP_REMOTE_GROUPS). The attacker-controlled value becomes indistinguishable from the trusted auth gateway value. Patch before trusting this auth chain. See the GitHub Security Advisory GHSA-f59h-q822-g45g for the full proof-of-concept.

Caddy as a static file server only

FastCGI CVEs do not apply. File matcher backslash bypass (CVE-2026-27585) primarily affects Windows environments. Still update for the admin API issues and the host matcher fix.

The underscore-header breaking change — check before you update

The fix chosen for CVE-2026-52845 in 2.6.2-12+deb13u1 (and upstream 2.11.4) drops every request header whose name contains an underscore, across all servers and without an opt-out. This is quoted directly from the Debian advisory text:

The fix for CVE-2026-52845 follows upstream in dropping every request header whose name contains an underscore, for all servers and without an opt-out. Deployments which pass such headers through Caddy, for instance X_Api_Key or gRPC custom metadata keys containing underscores, need to switch to the hyphenated spelling.

Before updating, check your Caddy configuration and any upstream services for:

• Custom authentication headers with underscores (X_Api_Key, X_Auth_Token, Remote_User)
• gRPC metadata keys with underscores
• Any forward_auth copy_headers entries using underscore names
• Downstream applications that receive headers from Caddy and use underscore-based naming

Switch affected headers to the hyphenated equivalent (X-Api-Key, X-Auth-Token, Remote-User) before or immediately after updating. The update itself does not warn you; the headers will simply be missing from downstream requests.

Ubuntu and other non-Debian installations

No Ubuntu Security Notice (USN) for this Caddy advisory batch was published as of 2026-08-21. Ubuntu ships Caddy in the universe repository and Caddy is also commonly installed from the official Caddy apt repository or as a snap. If you are on Ubuntu, check your installed Caddy version directly: run caddy version at a terminal prompt.

All eight CVEs in DSA-6429-1 are fixed in upstream 2.11.4. If your installed version is lower — whether from Ubuntu universe, the official Caddy repo, Docker, or a binary download — you are running an affected version.

Check the Ubuntu Security Notices page for a USN covering this batch; if none exists, track the Caddy GitHub releases directly.

What this means for Caddy as an access layer

The self-hosting community commonly places Caddy in front of internal tools as an authentication proxy — using forward_auth to gate access via Authelia, Authentik, or Traefik Forward Auth. CVE-2026-52845 is a direct attack on this pattern: it shows that the auth boundary created by forward_auth is only as trustworthy as the Caddy version.

This fits a broader pattern in access-control layering for self-hosted dashboards: the proxy enforcing authentication must itself be patched. An unpatched Caddy can be used to inject identity into the very application it is supposed to protect.

The same logic applies to the admin API CSRF issue (CVE-2026-27589): Caddy’s own configuration is a target. Keeping admin interfaces off the public internet extends to Caddy’s admin API — though by default it listens on localhost only, machines where a browser is also in use are still within scope for the CSRF attack.

Sources and next steps

1. Confirm your Caddy version.
2. Check for underscore headers before patching.
3. For Debian Trixie: check that the security-updated version (2.6.2-12+deb13u1) is listed in apt-cache policy caddy. If the version does not appear as Candidate, run apt update to refresh package lists first.
4. For upstream installations: upgrade to 2.11.4 or later.
5. After updating, verify that downstream auth flows and custom header passes still work as expected.

Primary sources:

• Debian DSA-6429-1: Debian Security Announce list
• Debian security tracker: CVE-2026-27588
• GitHub Advisory GHSA-f59h-q822-g45g (CVE-2026-52845): FastCGI header normalization bypass
• Tenable plugin 334443: DSA-6429-1 details
• Ubuntu security notices: ubuntu.com/security/notices

For the general exposure-review discipline when a package update arrives, see how to handle an Apache security notice — the same discipline applies to Caddy.