Executive brief
Caddy is a web server platform used to host websites and manage network traffic. A security flaw in its remote administration interface allows an authorized user with restricted access to bypass those restrictions and modify or view configuration settings they should not be able to reach. This could allow a low-privileged administrator to change how the server handles traffic or access sensitive internal configuration data.
Technical details
An authorization bypass exists in Caddy's remote admin API due to an inconsistency between path-based authorization and configuration traversal. The authorization layer uses string prefix matching (e.g., allowing access to '/config/.../routes/0'), while the traversal layer parses array indices numerically using 'strconv.Atoi()'. An attacker with a restricted admin certificate can use leading zeros (e.g., requesting '/config/.../routes/01') to satisfy the prefix match for index '0' while the traversal layer resolves the path to index '1'. This allows an authenticated remote administrator to read or modify configuration objects outside of their assigned scope. The issue is fixed in version 2.11.3.
Affected products
- Caddyserver Caddy >= 2.4.0, < 2.11.3
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published by maintainers
- 2026-06-23: disclosed: CVE published to NVD
- 2026-06-23: patched: Fix released in version 2.11.3