PT-2026-21774 · Caddy · Caddy

1Seal · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27589

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1

Description The local Caddy admin API, listening by default on 127.0.0.1:2019, includes a POST /load endpoint that allows replacing the entire running configuration. When origin enforcement is not enabled (enforce origin not configured), this endpoint accepts cross-origin requests, potentially from attacker-controlled web content in a victim's browser. This allows an attacker to apply an attacker-supplied JSON config, altering HTTP server behavior without user intent. The vulnerable component is the adminLoad.handleLoad function located at caddyconfig/load.go (specifically, the /load admin endpoint). An attacker can change admin listener settings or alter HTTP server behavior by exploiting this issue.

Recommendations Versions prior to 2.11.1: Ensure cross-origin web content cannot trigger POST /load on the local admin API. Enable origin enforcement for unsafe methods. Alternatively, require an unguessable token for /load and other state-changing admin endpoints.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-27589

GHSA-879P-475X-RQH2

GO-2026-4537

SUSE-SU-2026:0757-1

Affected Products

Caddy

References · 126

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27589.json · Exploit
• 🔥❌ https://github.com/user-attachments/files/25079820/PR_DESCRIPTION.md · Exploit, Deleted
• 🔥❌ https://github.com/user-attachments/files/25079818/poc.zip · Exploit, Deleted
• https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4537 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-879p-475x-rqh2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27589 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27589 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27589 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27589 · Security Note
• https://ubuntu.com/security/CVE-2026-27589 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27589 · Vendor Advisory
• https://github.com/caddyserver/caddy · Note