CVE-2026-24853

High

Published: 13 February 2026

Published

13 February 2026

Modified

24 February 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 20.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24853 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Caido Caido. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

AC-3 enforces approved authorizations for access to system resources, directly mitigating the improper domain whitelisting bypassed by spoofed X-Forwarded-Host headers.

SI-10 Information Input Validation good match

prevent

SI-10 requires validation of information inputs such as HTTP headers, preventing spoofing of X-Forwarded-Host to bypass host/IP restrictions.

SC-7 Boundary Protection good match

preventdetect

SC-7 monitors and controls communications at external interfaces like port 8080, blocking or detecting unauthorized access attempts exploiting header spoofing.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is an authentication bypass (CWE-290) in the public-facing Caido web toolkit on port 8080, directly enabling adversaries to exploit a vulnerable Internet-facing application via crafted X-Forwarded-Host headers for unauthorized access and arbitrary actions.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by…

injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This vulnerability is fixed in 0.55.0.

Deeper analysisAI

CVE-2026-24853 affects Caido, a web security auditing toolkit, in versions prior to 0.55.0. The vulnerability stems from an improper enforcement of domain whitelisting on port 8080, where Caido is designed to block connections from non-whitelisted hosts or IPs and display an error message across endpoints. However, this control can be bypassed by injecting an X-Forwarded-Host header set to 127.0.0.1:8080, allowing unauthorized access. The issue is classified under CWE-290 (Authentication Bypass by Spoofing) with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts on confidentiality, integrity, and availability.

Remote attackers with no privileges or user interaction required can exploit this vulnerability over the network, though it demands high attack complexity. By crafting requests with the spoofed X-Forwarded-Host header, adversaries can circumvent the whitelisting restrictions, gain unauthorized connectivity to Caido's 8080 port, and potentially execute arbitrary actions on the targeted instance, leading to high-level compromise of the auditing toolkit.

The GitHub Security Advisory (GHSA-3q5q-p8vj-8783) confirms the vulnerability and states that it is fully addressed in Caido version 0.55.0, recommending immediate upgrades to mitigate the bypass. No additional workarounds are detailed in the provided information.