{"items":[{"id":"NVI-00018638","kind":"vulnerability","title":"Caddy Defender trusted proxy client IP bypass","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3h23-rrpc-3p87","CVE-2026-46415"],"plain_summary":"GitHub lists this reviewed advisory for pkg.jsn.cam/caddy-defender. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-49293301969c0b1a06b2e595f8c8e891"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-05-19T20:29:18.000Z","value":"8.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-49293301969c0b1a06b2e595f8c8e891"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-49293301969c0b1a06b2e595f8c8e891","url":"https://github.com/advisories/GHSA-3h23-rrpc-3p87","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3h23-rrpc-3p87","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T07:02:15.138Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-49293301969c0b1a06b2e595f8c8e891"],"technology":"pkg.jsn.cam/caddy-defender","known_exclusions":[],"conditions_summary":"### Impact\n\nCaddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy.\n\nIn deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value.\n\nAs a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP.\n\n### Patches\n\nThe issue is fixed by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP.\n\nUsers should upgrade to `v0.10.1` or later.\n\n### Workarounds\n\nThere is no complete workaround in affected Defender versions for deployments that rely on Caddys trusted proxy client IP resolution.\n\nUntil upgrading, a","public_affected_ranges":["< 0.10.1"]}],"null_published_at":"2026-11-07T07:07:39.866Z","source_updated_at":"2026-05-19T20:29:18.000Z","source_disclosed_at":"2026-05-19T20:29:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T07:02:15.138Z"}],"next_cursor":null,"snapshot_revision":"42594"}