CVE-2026-46415
Received Received - Intake

Security Bypass in Caddy Defender Plugin

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value. As a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP. The issue is fixed in version 0.10.1 by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP. There is no complete workaround in affected Defender versions for deployments that rely on Caddy's trusted proxy client IP resolution. Until upgrading, affected users should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layer before traffic reaches Caddy. Deployments where Caddy receives traffic directly from clients, without an intermediate trusted proxy, are not affected by this bypass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-46415
EUVD
EUVD-2026-45975

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jasonlovesdoggo caddy_defender to 0.10.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46415 is a security flaw in the Caddy Defender plugin for Caddy web server. It allows attackers to bypass IP-based blocking by exploiting how Defender checks client IPs. Normally, Caddy resolves the real client IP behind proxies, but Defender used the immediate proxy IP instead. This lets blocked users access the server if their traffic passes through an unblocked proxy.

Detection Guidance

Check Caddy Defender version with: caddy list-modules | grep defender. If version is below 0.10.1, the system is vulnerable. Inspect Caddy logs for requests from blocked IPs bypassing restrictions. Monitor network traffic for unexpected connections through trusted proxies.

Impact Analysis

If you use Caddy Defender behind a proxy, attackers could bypass IP restrictions by routing traffic through unblocked proxies. This could allow unauthorized access to your server or services. The impact depends on your deployment: exposed admin panels, APIs, or sensitive endpoints may be at risk if IP blocking is your primary defense.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access to protected data. If IP-based blocking is used to restrict access to sensitive resources, attackers could bypass these controls by routing traffic through unblocked proxies. This may result in unauthorized data exposure, violating GDPR's data protection principles or HIPAA's access control requirements.

Mitigation Strategies

Upgrade Caddy Defender to version 0.10.1 or later. If upgrading is not possible, implement IP blocking at the trusted proxy, firewall, or edge layer before traffic reaches Caddy. Avoid relying solely on Defender for IP-based blocking in proxy environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46415. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart