CVE-2026-24853
High
Description
Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This vulnerability is fixed in 0.55.0.
SeverityHigh
CVSS8.1
Exploit probability—
ProductCaido
PublishedFeb 13, 2026
First seenFeb 13, 2026
Weakness typeCWE-290CWE-290
How to fix
Update
- caido caido0.55.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| caido caido | v < 0.55.0 | 0.55.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.