CVE-2026-27589mediumCWE-352

CVE-2026-27589: falha de média gravidade em caddyserver caddy

Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar caddy+ Monitorar github.com/caddyserver/caddy/v2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.2%
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
caddyserver · caddy
CVEs relacionadas — caddyserver caddy

No mesmo produto, das mais perigosas para as menos.

CVE-2026-45135HIGHCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesEPSS 0.7%CVE-2026-52844HIGHCaddy: Windows `file_server` path authorization bypass via encoded backslashEPSS 0.6%CVE-2026-27590HIGHCaddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportEPSS 0.6%CVE-2026-55458LOWCaddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughEPSS 0.5%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.5%CVE-2026-30852MEDIUMCaddy: vars_regexp double-expands user input, leaking env vars and filesEPSS 0.5%