medium CVSS 5.4 EPSS 0.24%

CVE-2026-45692·Caddy vulnerability

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

Severity
medium
Software
Caddy
Fixed in
2.11.3
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.24% — higher than 14% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 2.4.0

Until: 2.11.3

Fixed in: 2.11.3

How to fix this CVE

Upgrade Caddy to version 2.11.3 or later to resolve a path authorization bypass vulnerability in the admin API configuration endpoint. This flaw allows authenticated users to access and modify configuration objects they should not have permission to reach by exploiting a mismatch between authorization checks and path traversal logic. Update immediately if you rely on Caddy's admin API with role-based access controls.

sudo dnf update caddy

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|PUT|DELETE /config/apps/http/servers/[0-9]+/routes/[0-9]+/ - requests to configuration paths with array indices from authenticated API clients that differ from the initially authorized path prefix

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement IP-based access restrictions on the Caddy admin API listener (bind to localhost or a private network only); restrict POST/PUT/DELETE methods to /config/* to authorized internal networks; enforce mutual TLS between admin clients and Caddy if the API must be exposed over a network.

How to check if you are affected

  1. Run 'caddy version' to check the installed Caddy release number; versions 2.4.0 through 2.11.2 are vulnerable
  2. Verify if the admin API is exposed by checking Caddy's configuration file (usually /etc/caddy/Caddyfile) for an 'admin' directive or listening on localhost:2019
  3. Review Caddy access logs for requests to /config/apps/http/servers/*/routes/*/matchers/* or similar nested config paths originating from authenticated sessions
  4. After upgrading, run 'caddy version' again and confirm the version is 2.11.3 or higher, then restart Caddy with 'sudo systemctl restart caddy'

FAQ

What is CVE-2026-45692?

This vulnerability exists in Caddy's admin API where the authorization layer and the configuration endpoint use different methods to interpret path strings, allowing an authenticated user to bypass access controls and modify configuration objects outside their permission scope.

Is CVE-2026-45692 being actively exploited?

No, this CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available, though the vulnerability is straightforward to exploit if admin API access is exposed.

What versions of Caddy are affected by CVE-2026-45692?

Caddy versions 2.4.0 through 2.11.2 are vulnerable; version 2.11.3 and all later releases contain the fix.

How do I check if my server is vulnerable to CVE-2026-45692?

Run 'caddy version' and compare the output to version 2.11.3; if your version is lower, you are vulnerable. Additionally, verify admin API exposure with 'netstat -tlnp | grep caddy' to confirm if port 2019 is listening.

Does Defensia detect CVE-2026-45692?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Caddy is installed on a monitored server, CVE-2026-45692 will appear in your dashboard with remediation steps.

Related Caddy CVEs

CVE-2026-27590CVSS 9.8Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
CVE-2026-52845CVSS 8.1Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
CVE-2026-45135CVSS 8.1Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
CVE-2026-52844CVSS 7.5Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
CVE-2026-52846CVSS 4.2Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-45692. Free for 1 server.

Get started free