CVE-2026-24853
Published: 13 February 2026
Summary
CVE-2026-24853 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Caido Caido. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-24853 affects Caido, a web security auditing toolkit, in versions prior to 0.55.0. The vulnerability stems from an improper enforcement of domain whitelisting on port 8080, where Caido is designed to block connections from non-whitelisted hosts or IPs and display an error message across endpoints. However, this control can be bypassed by injecting an X-Forwarded-Host header set to 127.0.0.1:8080, allowing unauthorized access. The issue is classified under CWE-290 (Authentication Bypass by Spoofing) with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts on confidentiality, integrity, and availability.
Remote attackers with no privileges or user interaction required can exploit this vulnerability over the network, though it demands high attack complexity. By crafting requests with the spoofed X-Forwarded-Host header, adversaries can circumvent the whitelisting restrictions, gain unauthorized connectivity to Caido's 8080 port, and potentially execute arbitrary actions on the targeted instance, leading to high-level compromise of the auditing toolkit.
The GitHub Security Advisory (GHSA-3q5q-p8vj-8783) confirms the vulnerability and states that it is fully addressed in Caido version 0.55.0, recommending immediate upgrades to mitigate the bypass. No additional workarounds are detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7360
Vulnerability details
Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by…
more
injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This vulnerability is fixed in 0.55.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass (CWE-290) in the public-facing Caido web toolkit on port 8080, directly enabling adversaries to exploit a vulnerable Internet-facing application via crafted X-Forwarded-Host headers for unauthorized access and arbitrary actions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly mitigating the improper domain whitelisting bypassed by spoofed X-Forwarded-Host headers.
SI-10 requires validation of information inputs such as HTTP headers, preventing spoofing of X-Forwarded-Host to bypass host/IP restrictions.
SC-7 monitors and controls communications at external interfaces like port 8080, blocking or detecting unauthorized access attempts exploiting header spoofing.