CVE-2026-24853: 
NixOS vulnerability analysis and mitigation

CVE-2026-24853 is an authentication bypass vulnerability in Caido, a web security auditing toolkit, that allows attackers to circumvent the application's domain whitelist protection via HTTP header injection. Prior to version 0.55.0, Caido blocks non-whitelisted domains from accessing port 8080, but this control can be bypassed by injecting an X-Forwarded-Host: 127.0.0.1:8080 header, effectively spoofing a trusted local origin. The vulnerability was published on February 13, 2026, and is classified as CWE-290 (Authentication Bypass by Spoofing). The GitHub Security Advisory assigns it a CVSS v3.1 score of 8.1 (High), while NVD rates it 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is an insufficient patch for a prior DNS rebinding vulnerability (CVE-2025-49004), where Caido's host/IP allowlist enforcement on port 8080 fails to account for the X-Forwarded-Host HTTP header (CWE-290: Authentication Bypass by Spoofing). When an attacker injects X-Forwarded-Host: 127.0.0.1:8080 into a request, the application treats the request as originating from a trusted local address, bypassing the domain whitelist check entirely. Exploitation requires no authentication and no user interaction, though the GitHub advisory notes attack complexity as High due to the prerequisite that a user must have allowed a controlled domain to open popups (not required in headless mode). The advisory notes that if a user permitted a controlled domain to open popups, an attacker can leverage this bypass to achieve Remote Code Execution (RCE) on the user's system (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to bypass Caido's host/IP whitelisting controls and gain unauthorized access to restricted auditing features and endpoints on port 8080. The advisory states the impact is equivalent to CVE-2025-49004, which can lead to Remote Code Execution on the user's system if the attacker controls a domain the user has permitted to open popups. The vulnerability carries high impact across confidentiality, integrity, and availability, potentially enabling full compromise of the Caido instance and the underlying host (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been observed as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.041%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A blog post from infinitsec.net titled "Caido has an insufficient patch for DNS rebind leading to RCE" was published shortly after disclosure, which may provide additional technical context (Feedly).

1. Reconnaissance: Identify a target running Caido prior to version 0.55.0 with port 8080 accessible, either directly or via a web browser on the victim's machine. Determine if the target is running in headless mode (which does not require popup permissions) or standard mode.
2. Craft malicious request: Prepare an HTTP request targeting any Caido endpoint on port 8080 that would normally be blocked due to the domain whitelist. Add the header X-Forwarded-Host: 127.0.0.1:8080 to the request.
3. Bypass whitelist: Send the crafted request to the Caido instance. The application reads the X-Forwarded-Host header and treats the request as originating from the trusted local address 127.0.0.1, bypassing the "Host/IP is not allowed to connect to Caido" restriction.
4. Access restricted endpoints: With the whitelist bypassed, interact with Caido's internal API endpoints that were previously protected, enabling unauthorized access to auditing features and sensitive data.
5. Achieve RCE (if applicable): If the victim has granted popup permissions to an attacker-controlled domain (or if Caido is running in headless mode), leverage the whitelist bypass to trigger Remote Code Execution on the victim's system, consistent with the impact of CVE-2025-49004 (GitHub Advisory).

• Network: Unexpected HTTP requests to Caido's port 8080 from external or non-whitelisted IP addresses; requests containing the X-Forwarded-Host: 127.0.0.1:8080 header in access logs.
• Logs: Caido access logs showing requests to restricted endpoints that should have been blocked by the host/IP whitelist, particularly those with spoofed X-Forwarded-Host headers referencing 127.0.0.1 or localhost.
• Process: Unusual child processes spawned by the Caido process, potentially indicating successful RCE exploitation (e.g., shell commands, network utilities).
• Network: Outbound connections from the Caido host to unknown external IP addresses following suspicious inbound requests to port 8080 (GitHub Advisory).

Users should immediately upgrade Caido to version 0.55.0 or later, which contains the fix for this vulnerability (GitHub Advisory). As a temporary workaround for those unable to update, the advisory recommends disabling Guest mode in the Caido settings to reduce the attack surface. As a defense-in-depth measure, restrict network access to port 8080 at the firewall level to trusted hosts and networks only, and monitor access logs for suspicious X-Forwarded-Host headers targeting local IP addresses (Red Hat CVE).

The vulnerability was reported by security researcher bhavya32 and published by Caido maintainer Sytten via GitHub Security Advisory on February 13, 2026 (GitHub Advisory). A technical blog post from infinitsec.net specifically analyzing the insufficient patch for DNS rebinding leading to RCE was published shortly after disclosure, indicating community interest in the bypass mechanism. The vulnerability was also covered by cyberhub.blog as part of a roundup of notable CVEs published on February 14, 2026.