CVE-2026-27589
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Feb 24, 2026
CISA due date
—
The record
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/caddyserver/caddy/v2 | 0 | 2.11.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4537 Caddy is vulnerable to cross-origin config application via local admin API /load in… Same vulnerability
- GO-2026-4535 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4539 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4536 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4541 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4538 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27588 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27590 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2