CVE-2026-15743

Executive Summary

CVE-2026-15743 is an information disclosure vulnerability affecting Catalyst::Plugin::Static::Simple versions through 0.38, a static file serving plugin for the Catalyst Perl web framework. The plugin's _serve_static method unconditionally sets the Cache-Control header to "public" on all responses, including those served to authenticated users or responses containing sensitive data, thereby instructing shared/proxy caches and CDNs that the content is safe to store and reuse across different users' requests.

This misconfiguration causes sensitive content to be cached in shared infrastructure, where it can be retrieved by unauthorized parties, potentially exposing authenticated data, session-related content, or user-specific documents. The vulnerability is particularly severe because the documented mitigation of setting expires to "0" to disable caching is ignored by the plugin, meaning affected deployments have no effective configuration-level remediation. As of this analysis, no official patch has been released, and the vulnerability remains open across all affected versions.

Technical Analysis

The vulnerability resides in the Catalyst::Plugin::Static::Simple Perl module, which handles serving of static files and assets within Catalyst web applications. Static files are typically expected to be non-sensitive and safe to cache; however, this plugin is sometimes used in conjunction with application routes that serve dynamic or user-specific content, or it may serve files from directories that contain sensitive data.

The core flaw is in the _serve_static method, which is responsible for generating HTTP response headers when serving static content. Regardless of the nature of the content being served, the method always injects Cache-Control: public into the response headers. This header directive is an explicit instruction to any intermediary caching system — including forward proxies, reverse proxies, CDNs, and corporate caching appliances — that the response is shareable and may be stored in a shared cache.

The critical security implication is that cached responses can later be replayed to any client requesting the same URL, even if the original request contained an Authorization header or other authentication context. According to HTTP caching semantics (RFC 7234), a response marked as "public" may be cached even if it would normally be considered non-cacheable due to the presence of authentication. This means that if a static file route serves content that varies per user (for example, a generated report, a temporary export, or a user-specific asset), the content from one user's request could be stored in a shared cache and served to any other user who requests the same URL.

The documented mitigation — setting the expires configuration parameter to "0" — is ineffective. The NVD description explicitly states that this configuration is ignored by the plugin, meaning that even administrators who attempted to disable caching and followed the vendor documentation remain exposed.

Insufficient technical detail is available regarding the exact code path and configuration options for this plugin, as the NVD description does not enumerate specific configuration keys or code snippets beyond the method name _serve_static and the Cache-Control header value.

Attack surface: any Catalyst application that uses this plugin to serve static content, particularly those that place dynamically-generated or user-scoped files within the static file directories, or those that rely on the plugin for serving files that should not be publicly cached.

Exploitation Scenarios

No public proof-of-concept exploit is known at this time. The attack chain described below is inferred from the vulnerability class and the NVD description.

Scenario 1: Proxy Cache Poisoning via Shared Cache

1. Reconnaissance: An attacker identifies a target Catalyst application using static file serving. They probe for the presence of a shared caching layer (e.g., they issue requests with varying Accept headers and check for Age response headers or X-Cache headers that indicate a cache hit).

2. Trigger: The attacker identifies a static URL that serves user-specific content — for example, an exported document, a temporary token file, or a personalized asset generated by the application. They observe that the response includes Cache-Control: public.

3. Execution: The attacker relies on a legitimate (or compromised) user to access the URL. Because the Cache-Control header instructs the shared cache to store the response, the content is cached at the proxy/CDN layer.

4. Post-Exploitation Impact: The attacker (or any other user) requests the same URL without authentication and receives the cached response, obtaining the sensitive content that was originally generated for another user. This can include personally identifiable information, financial documents, or session-related tokens.

Scenario 2: Authorization Bypass Through Cache Replay

1. Reconnaissance: The attacker discovers a URL pattern that serves user-scoped static content (e.g., /static/exports/{user_id}/{filename}).

2. Trigger: A victim with legitimate access requests their own file. The proxy caches the response as "public."

3. Execution: The attacker accesses the same URL without any authentication header.

4. Post-Exploitation Impact: The cache serves the victim's file to the attacker, effectively bypassing application-level authorization controls.

Note: The Cache-Control header is set with no means of overriding it — the application developer cannot easily disable this behavior per-route or globally, making this a persistent exposure for all affected deployments.

Impact Assessment

Based on CVSS v3.1 sub-scores (where applicable; the assigned CVSS score is N/A, but we assess based on the described behavior):

• Confidentiality Impact: HIGH — Sensitive user-specific data can be exposed to unauthorized parties through shared cache replay. The cache acts as an unintended data repository that bypasses authentication and authorization controls.
• Integrity Impact: LOW — The vulnerability itself does not allow modification of data, but a cached response could become stale or poisoned by an attacker who manages to inject crafted content into the cache before the legitimate user's request.
• Availability Impact: NONE — The flaw does not directly impact availability.

Business Impact:

• Exposure of sensitive user data (PII, financial records, proprietary documents) can lead to regulatory fines (GDPR, HIPAA, PCI-DSS) and loss of customer trust.
• Since the vulnerability affects the "public" cache directive, data may persist in shared infrastructure beyond the application's lifecycle, making data removal difficult.
• The flaw is systemic — it affects all static file responses from the application, not a specific endpoint — broadening the potential blast radius.

Affected Systems:

• All Catalyst::Plugin::Static::Simple versions through 0.38.
• Deployment environments where a shared cache, reverse proxy, or CDN sits in front of the application.
• Applications that serve any dynamic or user-specific content through the static file mechanism.

CVSS Note: The NVD has not assigned a CVSS score (N/A). However, based on the described impact, a qualitative assessment places this in the HIGH severity range (potential CVSS v3.1 score of 7.5–8.2, vector approximating AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, though this is an analyst estimate and not an official score).

EPSS: Not yet scored by FIRST.org.

Detection Guidance

The following detection rules focus on identifying: (a) responses with inappropriate Cache-Control: public headers for authenticated or sensitive content, and (b) unauthorized access to cached content.

Sigma Rule

title: Catalyst Static Plugin - Cache-Control Public with Authorization Header
id: 3a9c7e45-8d2f-4b1a-9e5c-2f6d8a3b1c4d
status: experimental
description: Detects HTTP responses from Catalyst applications that include both Cache-Control: public and an Authorization header, indicating sensitive content may be cached in shared infrastructure (CVE-2026-15743).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15743
tags:
    - attack.t1190
    - cve.2026.15743
    - cwe.524
logsource:
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-extension: "static"
        cache-control|contains: "public"
        authorization|exists: true
    condition: selection
fields:
    - clientip
    - cs-uri-stem
    - authorization
falsepositives:
    - Legitimate public assets served with Authorization header (uncommon)
level: high

YARA Rule

rule CVE_2026_15743_Catalyst_Static_Cache {
    meta:
        description = "Detects Catalyst::Plugin::Static::Simple responses with Cache-Control public header (CVE-2026-15743)"
        author = "Valters IT Security"
        date = "2026-02-01"
        reference = "CVE-2026-15743"
        severity = "high"
    strings:
        $cache_control = "Cache-Control: public" ascii nocase
        $catalyst_header = "Catalyst" ascii nocase
        $auth_header = "Authorization:" ascii nocase
        $static_path = "/static/" ascii nocase
    condition:
        $cache_control and $catalyst_header and $auth_header and $static_path
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-15743 Catalyst Static Simple - Cache-Control public with auth";
    flow:established,to_client;
    content:"Cache-Control|3a| public";
    content:"Authorization|3a|";
    content:"/static/";
    http_header_names;
    metadata:created_at 2026_02_01, updated_at 2026_02_01, cve CVE_2026_15743;
    sid:20260201;
    rev:1;
)

Elastic Detection

// Identify Cache-Control: public headers served by Catalyst applications
sequence by host, source.ip
  [http where response.headers.cache-control == "public" and request.headers.authorization != null and response.status_code == 200]
  [network where protocol == "http"]

Splunk SPL Query

index=proxy sourcetype=access_combined
| where match(cache_control, "public")
| where isnotnull(authorization)
| where match(request_path, "/static/")
| table _time, clientip, request_path, cache_control, status
| stats count by clientip, request_path

Wazuh OSSEC Rule

<group name="catalyst, cve-2026-15743,">
    <rule id="202601" level="12">
        <if_sid>general</if_sid>
        <match>Cache-Control: public</match>
        <regex>Authorization: </regex>
        <regex>/static/</regex>
        <description>CVE-2026-15743: Catalyst Static::Simple plugin serving content marked as publicly cacheable in presence of Authorization header</description>
        <group>catalyst, cve, cwe-524,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch is available from any tracked source at the time of this report. The official Perl module repository has not released a fixed version beyond 0.38, and the vendor (Catalyst) has not acknowledged or published a remediation timeline.

Immediate Mitigations (Configuration Level):

1. Restrict Shared Cache Exposure: Configure your reverse proxy, CDN, or load balancer to strip the Cache-Control header for responses originating from the Catalyst application, particularly those under the /static/ URI path. Alternatively, override the header to private or no-store at the reverse proxy level.
2. Disable Caching for Sensitive Routes: In your reverse proxy (nginx, Apache, Varnish), configure rules to prevent caching of any request that includes an Authorization header. Example (nginx):

   proxy_no_cache $http_authorization;
   proxy_cache_bypass $http_authorization;
   

3. Avoid Serving Dynamic Content via Static Plugin: Refactor applications to ensure no user-specific or generated content is ever served through the static file plugin. Move such content behind a dynamic controller that sets appropriate Cache-Control: no-store headers.

Patch / Upgrade Steps:

1. Monitor the Catalyst::Plugin::Static::Simple CPAN distribution for a new release. Once a fixed version (expected to be 0.39 or later) is published, update the Perl module:

   cpanm Catalyst::Plugin::Static::Simple
   

2. Subscribe to the Catalyst project security advisories and the NVD feed for CVE-2026-15743 to receive timely patch notifications.

Long-Term Hardening:

1. Implement a Content Security Policy (CSP) and appropriate HTTP headers at the application layer to enforce no-store on all authenticated responses.
2. Conduct an audit of all routes and file-serving mechanisms in the application to ensure no sensitive content passes through the static file plugin.
3. Deploy Web Application Firewall (WAF) rules to block direct requests to known sensitive static paths without proper authentication.
4. Regularly review cache configuration and test for cache-related vulnerabilities using automated tools (e.g., burst, or manual curl checks for Age / X-Cache headers on authenticated content).
5. Consider removing the Cache-Control header handling from the plugin level and managing it centrally at the web server or application middleware layer.

References

1. NVD — CVE-2026-15743: https://nvd.nist.gov/vuln/detail/CVE-2026-15743
2. Catalyst::Plugin::Static::Simple CPAN Module: https://metacpan.org/pod/Catalyst::Plugin::Static::Simple
3. RFC 7234 — HTTP Caching Semantics (reference for Cache-Control: public implications): https://datatracker.ietf.org/doc/html/rfc7234
4. CWE-524 — Use of Cache Containing Sensitive Information: https://cwe.mitre.org/data/definitions/524.html
5. CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-15743 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for this CVE at the time of writing. The vulnerability is unpatched, and as it becomes more widely known, it is plausible that reconnaissance tools and automated scanners will begin targeting Catalyst applications for cache-poisoning attempts. Enterprises running Catalyst applications with shared caching infrastructure should treat this as a high-priority remediation item despite the absence of observed exploitation.