CVE-2026-27589 - Vulnerability Analysis

Overview

Caddy < 2.11.1 contains a cross-site request forgery caused by missing origin enforcement on the local admin API's POST /load endpoint, letting attackers change server configuration via cross-origin requests, exploit requires origin enforcement disabled.

Severity & Score

Impact

Attackers can change server configuration remotely via cross-origin requests, potentially altering server behavior without user consent.

Mitigation

Update to version 2.11.1 or later.

References

• https://github.com/user-attachments/files/25079820/PR_DESCRIPTION.md
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1
• https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2
• https://github.com/user-attachments/files/25079818/poc.zip

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner