Log in Start free

Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M

CVE-2026-27589Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

Medium 6.9

In plain English

A medium-severity cross-site request forgery in caddy from caddyserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23caddy2.11.2-r0ALPINE-CVE-2026-27589
Alpine:v3.24caddy2.11.1-r0ALPINE-CVE-2026-27589
Debian:12caddy2.6.2-5+deb12u1DEBIAN-CVE-2026-27589
Debian:13caddy2.6.2-12+deb13u1DEBIAN-CVE-2026-27589
Debian:14caddy2.11.2-1DEBIAN-CVE-2026-27589
Gogithub.com/caddyserver/caddy/v22.11.1GO-2026-4537
Gogithub.com/caddyserver/caddy/v22.11.1GHSA-879p-475x-rqh2
Ubuntu:25.10caddyno fix listedUBUNTU-CVE-2026-27589
Ubuntu:26.10caddyno fix listedUBUNTU-CVE-2026-27589

Affected products (as reported)

VendorProductVersions
caddyserver caddy < 2.11.1

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References