CVE-2026-46415 JasonLovesDoggo CVE debrief

Who should care

Users of Caddy Defender plugin behind trusted proxies, CDNs, or load balancers who expect Defender to enforce blocking based on the real client IP should be aware of this bypass vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who manage Caddy deployments. They should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Affected users should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The Caddy Defender plugin used `r.RemoteAddr` instead of Caddy's `client_ip` request variable to evaluate block requests. This allowed bypass when behind trusted proxies. Fixed in version 0.10.1 by preferring `client_ip` when available. The plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, the plugin did not correctly handle requests behind trusted proxies, CDNs, or load balancers. This could lead to clients from blocked IP ranges bypassing Defender. The issue affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP.

Defensive priority

High priority to upgrade to version 0.10.1 or apply compensating controls at the trusted proxy, CDN, load balancer, or firewall layer. Defenders should verify Caddy configuration for trusted proxies and client IP resolution. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Recommended defensive actions

• Upgrade Caddy Defender plugin to version 0.10.1 or later
• Enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, or firewall layer until upgrade
• Verify Caddy configuration for trusted proxies and client IP resolution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-20T16:17:01.163Z and was last modified on 2026-07-21T14:16:33.970Z. The NVD entry is currently Received. This information is based on the supplied source corpus. To verify, defenders should review the official CVE record and NVD entry for CVE-2026-46415. The Caddy Defender plugin, a middleware for Caddy, was vulnerable to a bypass issue due to its use of `r.RemoteAddr` instead of Caddy's resolved `client_ip` request variable. This allowed clients from blocked IP ranges to bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. The issue is fixed in version 0.10.1. Users should be aware of the potential impact and take necessary actions to mitigate the vulnerability.

Official resources