CVE-2026-45692: Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

Severity: low (CVSS 3.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-187

Description

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

Affected products

caddyserver caddy: from 2.4.0 before 2.11.3 — fixed in 2.11.3

How to fix

Upgrade to a fixed version: caddyserver caddy 2.11.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-45692 or the next vulnerability affects your stack