Read the docs
TI-2026-33434 Aliases CVE-2026-45692GHSA-x5w9-xh9r-mvfc

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

Priority MEDIUM 58CWE-187Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed caddy (caddyserver): 2.11.3github.com/caddyserver/caddy/v2 (Go): 2.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
caddyservercaddy2.4.0 to before 2.11.32.11.3Patch availableCNA
—github.com/caddyserver/caddy/v2 (Go)2.4.0 to before 2.11.32.11.3Patch availableGHSA-x5w9-xh9r-mvfc
  • caddy Vendorcaddyserver Affected 2.4.0 to before 2.11.3 Fixed in 2.11.3 Patch available CNA
  • github.com/caddyserver/caddy/v2 (Go) Vendor— Affected 2.4.0 to before 2.11.3 Fixed in 2.11.3 Patch available GHSA-x5w9-xh9r-mvfc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*2.4.0 to before 2.11.3Vulnerablecaddyserver
  • cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.11.3 Vulnerable ·caddyserver

Remediation

  • Fix · CNA caddy (caddyserver) Fixed in 2.11.3
  • Fix · GHSA-x5w9-xh9r-mvfc github.com/caddyserver/caddy/v2 (Go) Fixed in 2.11.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45692
  2. 2026-10-03 Alias added: GHSA-x5w9-xh9r-mvfc

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
  • TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
  • TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
  • TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
  • TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences