CVE-2026-27589: Caddyserver Caddy CSRF Vulnerability

CVE-2026-27589 Overview

CVE-2026-27589 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Caddy, an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local Caddy admin API (default listen 127.0.0.1:2019) exposes a state-changing POST /load endpoint that replaces the entire running configuration. When origin enforcement is not enabled (enforce_origin not configured), the admin endpoint accepts cross-origin requests from attacker-controlled web content in a victim's browser and applies an attacker-supplied JSON configuration. This can change the admin listener settings and alter HTTP server behavior without user intent.

Critical Impact
An attacker can leverage CSRF to completely replace the Caddy server configuration via the admin API, potentially redirecting traffic, exposing sensitive data, or disrupting service availability.

Affected Products

Caddyserver Caddy versions prior to 2.11.1

Discovery Timeline

2026-02-24 - CVE-2026-27589 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27589

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The Caddy web server includes a built-in admin API that listens on 127.0.0.1:2019 by default. This API provides powerful configuration management capabilities, including a POST /load endpoint that allows complete replacement of the running server configuration with a new JSON-based configuration.

The core issue stems from insufficient origin validation on state-changing API endpoints. When the enforce_origin option is not explicitly configured, the admin API accepts requests regardless of their origin. This means that if a user with access to the Caddy server (such as an administrator browsing locally) visits a malicious website, that website can craft JavaScript code to send requests to the local admin API endpoint.

Since the request originates from the victim's browser, it targets localhost:2019 and bypasses network-level protections. The attacker-supplied JSON configuration is then applied to the running Caddy instance, giving the attacker full control over the server's behavior.

Root Cause

The root cause is the lack of default origin enforcement on the Caddy admin API. The POST /load endpoint performs a state-changing operation (replacing the entire server configuration) but does not require proper origin validation or CSRF tokens when enforce_origin is not configured. This allows cross-origin requests from malicious web content to successfully interact with the API.

Attack Vector

The attack requires the victim to be browsing the web from a machine where Caddy is running with the admin API enabled and accessible on localhost. The attacker hosts malicious web content (e.g., a webpage with embedded JavaScript) that makes cross-origin requests to http://127.0.0.1:2019/load with a crafted JSON payload. When the victim visits the attacker's page, the browser executes the malicious JavaScript, which sends requests to the local Caddy admin API. Since the admin API does not validate the origin, it accepts and applies the attacker's configuration.

The attacker can use this to modify the HTTP server behavior, change admin listener settings, redirect traffic to attacker-controlled servers, inject malicious responses, or disable TLS protections. Technical details and a proof-of-concept are available in the GitHub Security Advisory.

Detection Methods for CVE-2026-27589

Indicators of Compromise

Unexpected configuration changes to the Caddy server without administrator action
Unusual requests to the POST /load endpoint in admin API access logs
Configuration entries pointing to unknown or suspicious upstream servers
Modified admin listener settings or binding addresses

Detection Strategies

Monitor admin API access logs for requests to /load endpoint originating from unexpected sources
Implement network monitoring for traffic to 127.0.0.1:2019 from browser processes
Review Caddy configuration files for unauthorized modifications
Deploy endpoint detection rules to identify JavaScript making requests to local admin APIs

Monitoring Recommendations

Enable verbose logging on the Caddy admin API to capture all configuration change requests
Implement file integrity monitoring on Caddy configuration files
Set up alerts for any configuration reload events that weren't initiated through approved processes
Monitor for browser-based network connections to localhost admin ports

How to Mitigate CVE-2026-27589

Immediate Actions Required

Upgrade Caddy to version 2.11.1 or later immediately
Enable enforce_origin in the admin API configuration as an interim measure
Review current Caddy configuration for any unauthorized changes
Consider disabling the admin API if not required for operations

Patch Information

The vulnerability has been fixed in Caddy version 2.11.1. Users should upgrade to this version or later to receive the security fix. The patch implements proper origin enforcement to prevent cross-origin requests from being accepted by the admin API. For more details, see the Caddy v2.11.1 release notes and the GitHub Security Advisory.

Workarounds

Configure enforce_origin in the admin block to validate request origins
Restrict the admin API to only accept connections from trusted sources using firewall rules
Disable the admin API entirely by setting admin off in the Caddyfile if administrative access is not needed
Use network segmentation to isolate systems running Caddy from untrusted browser traffic

bash

# Caddyfile configuration to enable origin enforcement
{
    admin :2019 {
        enforce_origin
        origins localhost:2019 127.0.0.1:2019
    }
}