Executive brief
Caddy Defender is a security plugin for the Caddy web server used to block malicious traffic based on a visitor's IP address. A flaw in how the plugin identifies visitors allows attackers to bypass security blocks if the server is sitting behind a load balancer, CDN, or proxy. This means that even if an administrator has blocked a specific harmful IP address, the attacker can still access the website because the plugin incorrectly sees the proxy's address instead of the attacker's real address.
Technical details
Caddy Defender prior to version 0.10.1 incorrectly relies on the 'r.RemoteAddr' property to evaluate IP-based blocking rules. In environments utilizing a trusted proxy, CDN, or load balancer, 'r.RemoteAddr' reflects the IP of the immediate network peer (the proxy) rather than the actual client. While Caddy itself resolves the true client IP into the 'client_ip' variable after applying 'trusted_proxies' policies, Defender ignores this resolved value. Consequently, an attacker from a blacklisted range can bypass restrictions if the intermediate proxy's IP is not also blocked. The vulnerability is resolved in version 0.10.1 by prioritizing Caddy's 'client_ip' variable.
Affected products
- JasonLovesDoggo caddy-defender < 0.10.1
Timeline
- 2026-07-20: disclosed
- 2026-07-20: advisory