CVE-2026-24853
Caido has an insufficient patch for DNS rebind leading to RCE
Résumé
Caido has an insufficient patch for DNS rebind leading to RCE
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This vulnerability is fixed in 0.55.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov