Caddy auth bypass in PKI remote admin endpoints

Executive brief

Caddy, a popular web server, contains a flaw in how it manages remote administrative access for its Public Key Infrastructure (PKI) features. An authorized user who is granted access to a specific administrative path can bypass restrictions to access other sensitive areas that share a similar name. This could allow an attacker to view or modify security certificates and configurations they should not have permission to manage.

Technical details

An authorization bypass exists in Caddy's remote admin access control for PKI endpoints. The vulnerability stems from the use of `strings.HasPrefix` in `admin.go` to validate request paths against allowed permissions. Because the implementation does not enforce path-segment boundaries, a client certificate authorized for a specific path (e.g., `/pki/ca/prod`) can successfully access sibling resources (e.g., `/pki/ca/prod-backup`) that share the same prefix. This allows an authenticated attacker with limited administrative privileges to interact with unauthorized Certificate Authority (CA) resources. The issue is fixed in version 2.11.3 by implementing segment-aware path matching.

Affected products

• caddyserver caddy < 2.11.3

Timeline

• 2026-05-13: advisory: Initial GitHub Advisory published
• 2026-05-19: other: Advisory updated

References

• https://api.github.com/users/Amemoyoi
• https://github.com/Amemoyoi
• https://api.github.com/users/Amemoyoi/gists%7B/gist_id%7D
• https://api.github.com/users/Amemoyoi/repos
• https://avatars.githubusercontent.com/u/193629772?v=4
• https://api.github.com/users/Amemoyoi/events%7B/privacy%7D