PatchSiren

JasonLovesDoggo CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH JasonLovesDoggo CVE published 2026-07-20

CVE-2026-46415

The Caddy Defender plugin, a middleware for Caddy, was vulnerable to a bypass issue. Prior to version 0.10.1, it used `r.RemoteAddr` to evaluate whether a request should be blocked, instead of Caddy's resolved `client_ip` request variable. This allowed clients from blocked IP ranges to bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. The issue is fixed in [truncated]