CVE-2026-46415
Caddy Defender trusted proxy client IP bypass
Description
The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value. As a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP. The issue is fixed in version 0.10.1 by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP. There is no complete workaround in affected Defender versions for deployments that rely on Caddy's trusted proxy client IP resolution. Until upgrading, affected users should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layer before traffic reaches Caddy. Deployments where Caddy receives traffic directly from clients, without an intermediate trusted proxy, are not affected by this bypass.
INFO
Published Date :
July 20, 2026, 4:17 p.m.
Last Modified :
Oct. 24, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-46415
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Caddy Defender plugin to version 0.10.1.
- Configure IP blocking at the edge if upgrading is not possible.
- Ensure trusted proxies correctly resolve client IP addresses.
- Avoid intermediate trusted proxies if direct client access is an option.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46415.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46415 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46415
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46415 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46415 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: caddy-defender de JasonLovesDoggo, Description: El plugin Caddy Defender es un middleware para Caddy que permite a los usuarios bloquear o manipular solicitudes basándose en la dirección IP del cliente. Antes de la versión 0.10.1, Caddy Defender utilizaba “r.RemoteAddr” al evaluar si una solicitud debía ser bloqueada. “RemoteAddr” es la dirección del par inmediato conectado a Caddy. En implementaciones donde Caddy está detrás de un proxy de confianza, CDN o balanceador de carga, el par inmediato suele ser el proxy, no el cliente original. Caddy resuelve la dirección del cliente original en su variable de solicitud “client_ip” después de aplicar la política “trusted_proxies” configurada, pero Defender no utilizaba ese valor. Como resultado, los clientes de rangos de dirección IP bloqueados podían eludir a Defender al acceder a Caddy a través de un proxy de confianza cuya propia dirección IP no estaba bloqueada. Esto afecta a las implementaciones que utilizan Defender detrás de proxies de confianza y esperan que aplique el bloqueo basándose en la dirección IP real del cliente. El problema se soluciona en la versión 0.10.1 haciendo que Defender prefiera la variable de solicitud “client_ip” resuelta de Caddy cuando esté disponible. Defender recurre a “RemoteAddr” solo cuando Caddy no ha proporcionado una dirección IP de cliente resuelta. No existe una solución alternativa completa en las versiones afectadas de Defender para implementaciones que dependen de la resolución de la dirección IP del cliente por parte del proxy de confianza de Caddy. Hasta la actualización, los usuarios afectados deben aplicar un bloqueo de dirección IP equivalente en el proxy de confianza, CDN, balanceador de carga, cortafuegos u otra capa perimetral antes de que el tráfico llegue a Caddy. Las implementaciones donde Caddy recibe tráfico directamente de los clientes, sin un proxy de confianza intermedio, no se ven afectadas por esta elusión. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 21, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-46415', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-21T13:52:55.935258Z'} -
New CVE Received by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'JasonLovesDoggo', 'product': 'caddy-defender', 'versions': [{'status': 'affected', 'version': '< 0.10.1'}]}] Added Description The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value. As a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP. The issue is fixed in version 0.10.1 by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP. There is no complete workaround in affected Defender versions for deployments that rely on Caddy's trusted proxy client IP resolution. Until upgrading, affected users should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layer before traffic reaches Caddy. Deployments where Caddy receives traffic directly from clients, without an intermediate trusted proxy, are not affected by this bypass. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Added CWE CWE-284 Added CWE CWE-348 Added Reference https://caddyserver.com/docs/caddyfile/matchers#client-ip Added Reference https://caddyserver.com/docs/caddyfile/options#trusted-proxies Added Reference https://github.com/JasonLovesDoggo/caddy-defender/pull/139 Added Reference https://github.com/JasonLovesDoggo/caddy-defender/security/advisories/GHSA-3h23-rrpc-3p87