Request Manipulation Vulnerability in Caddy Defender Middleware

CVE-2026-46415

What is CVE-2026-46415?

The Caddy Defender plugin, which enhances request blocking based on client IP addresses, had a flaw in its version prior to 0.10.1. It relied on r.RemoteAddr, which captures the immediate connection point, typically a trusted proxy when deployed in such environments. This caused clients using blocked IP ranges to potentially bypass protections if accessing Caddy through an unblocked proxy. The correct original client IP was resolvable via Caddy's client_ip, but Defender did not apply this correctly, leading to vulnerabilities in environments utilizing trusted proxies. This issue was rectified in version 0.10.1. Affected users must employ alternative blocking methods at the proxy or other edge layers until they can upgrade their Defender version.

References