CVE-2026-27589 Details
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.
A vulnerability exists in Caddy's local admin API, specifically in versions prior to 2.11.1. The issue arises from the `POST /load` endpoint, which allows cross-origin requests to replace the entire running configuration. When origin enforcement is disabled, an attacker can manipulate the admin settings and HTTP server behavior without the user's knowledge. This vulnerability requires the victim to be running Caddy with the admin API enabled and to visit an attacker-controlled webpage.
Users are advised to update to Caddy version 2.11.1 or later. Additionally, ensure that origin enforcement is enabled for the admin API to prevent unauthorized cross-origin requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caddyserver/caddy/releases/tag/v2.11.1 | [email protected] | Release Notes |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2 | [email protected] | ExploitMitigationVendor Advisory |
| https://github.com/user-attachments/files/25079818/poc.zip | [email protected] | Exploit |
| https://github.com/user-attachments/files/25079820/PR_DESCRIPTION.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| caddyserver caddy | < 2.11.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |