Bug 2442400 (CVE-2026-27589) - CVE-2026-27589 github.com/caddyserver/caddy/v2/modules/caddyhttp: Caddy: Unauthorized configuration modification via cross-origin requests to the admin API
Summary: CVE-2026-27589 github.com/caddyserver/caddy/v2/modules/caddyhttp: Caddy: Unau...
Keywords:
Status: NEW
Alias: CVE-2026-27589
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2442428 2488517
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-02-24 17:04 UTC by OSIDB Bzimport
Modified: 2026-06-12 20:14 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-02-24 17:04:19 UTC 
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.
Note You need to log in before you can comment on or make changes to this bug.