Is CVE-2026-92284 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92284 being exploited in the wild.

How severe is CVE-2026-92284?

Medium severity, with a CVSS score of 6.5, published 17 September 2026.

Which products and versions are affected?

github.com/caddyserver/caddy/v2 (Go) SEMVER:introduced=0,fixed=2.11.4.

Is there a fix for CVE-2026-92284?

Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92284 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92284?

Check whether you run github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92284: Caddy placeholder re-expansion in URI rewrite

CVE-2026-92284 · Severity: medium · CVSS 6.5 · Published 2026-09-17

Caddy is an extensible web server platform that handles HTTPS and request routing. In version 2.11.3 and earlier, a flaw in the URI rewrite handler allows attackers to inject malicious placeholders into query strings, potentially exposing sensitive environment variables, internal request data, or readable files on the server when certain configurations are used.

Technologies: github.com/caddyserver/caddy/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-92284 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92284 being exploited in the wild.
How severe is CVE-2026-92284?: Medium severity, with a CVSS score of 6.5, published 17 September 2026.
Which products and versions are affected?: github.com/caddyserver/caddy/v2 (Go) SEMVER:introduced=0,fixed=2.11.4.
Is there a fix for CVE-2026-92284?: Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92284 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92284?: Check whether you run github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.4 or later
```
go get github.com/caddyserver/caddy/v2@v2.11.4
```

Technical details

The vulnerability is a placeholder re-expansion flaw in the rewrite handler (modules/caddyhttp/rewrite/rewrite.go). When a rewrite URI template ends with a literal question mark and contains a placeholder that expands to client-controlled bytes (e.g. {http.request.header.X-Fwd}), those bytes flow into buildQueryString() which performs a second placeholder expansion pass. An attacker can inject placeholder syntax such as {env.SECRET} or {file./path} to disclose environment variables, files, or internal request variables. The attack requires specific rewrite configuration and is network-reachable without authentication. The fix, released in version 2.11.4, escapes curly braces in injected query strings to prevent re-expansion.

Affected products

Caddy Caddy 2.11.3 and earlier

Identifiers

CVE-2026-92284
CVE-2026-77281
CVE-2026-92700
GHSA-j8px-rmrx-76h9
GO-2026-6512

Timeline

2026-09-17: disclosed
2026-05-26: patched: Fix merged in version 2.11.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.