CVE-2026-24853 is a high severity flaw (CVSS 8.1) in Caido, the web security auditing toolkit. A forged header gets around the check that stops untrusted hosts from reaching Caido on port 8080. The advisory calls it an insufficient patch for an earlier DNS rebind issue. Caido 0.55.0 fixes it, for both caido and caido-desktop.
What's affected
- caido: all versions before 0.55.0.
- caido-desktop: all versions before 0.55.0.
- Fixed in: 0.55.0 for both packages.
The advisory is titled "Insufficient patch for DNS rebind leading to RCE". It says the impact should match CVE-2025-49004, the earlier issue this fix was meant to close. The weakness is classed as CWE-290 (Authentication Bypass by Spoofing). The CVSS vector rates attack complexity as high, with no privileges and no user interaction required.
How to check if you're exposed
Open Caido and check the version in the About screen or the settings. Anything below 0.55.0 is affected. If you run Caido on a shared workstation or a server, check every install, not just your own.
The advisory describes a specific condition. Remote code execution depends on a user having allowed an attacker controlled domain to open popups. That permission is not required in headless mode. Review which sites your Caido instance has permitted popups for, and whether Guest mode is switched on.
What to do now
- Upgrade Caido and caido-desktop to 0.55.0 or later.
- If you cannot upgrade yet, disable Guest mode in the settings. The advisory names this as the protection.
- Review any domains you have allowed to open popups, and remove ones you do not recognize.
- Check that Caido is not bound to an address that other machines can reach.
Why it matters
The server tried to block hosts it did not trust, then answered differently when a request carried an X-Forwarded-Host header naming a local address. That is a classic spoofing problem. The check trusted a value the client controls. The class is CWE-290 (Authentication Bypass by Spoofing).
Security tooling is a good target because it runs with trust on a machine full of sensitive traffic. A proxy you use to inspect other people's apps deserves the same patch discipline as the apps themselves. Keep a list of the security tools your team installs, with versions, so a fix like this is a five minute job.
Quick check
Is CVE-2026-24853 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not say it has been exploited. Patch anyway, because the impact it describes is code execution.
Does Guest mode matter?
Yes. The advisory says that if you cannot update, disabling Guest mode protects your instance.
Sources
Last reviewed: 19 October 2026.
