CVE-2026-45692: Caddy Path Traversal Vulnerability

CVE-2026-45692 Overview

CVE-2026-45692 affects Caddy, an extensible server platform that uses Transport Layer Security (TLS) by default. The vulnerability exists in versions from 2.4.0 until 2.11.3. The authorization layer and the /config traversal layer disagree on what object a given path refers to. A path authorized for one config object is accepted, then resolves to a different config object during traversal. The authorization layer performs string prefix matching, while the /config traversal layer parses array indices numerically using strconv.Atoi(). This parser differential maps to [CWE-187], inconsistent comparison of equivalent values. Caddy 2.11.3 contains the fix.

Critical Impact
An authenticated low-privilege user with access to a scoped path on the Caddy admin API can read or modify a different configuration object than the one their permissions allow.

Affected Products

Caddy server 2.4.0 through 2.11.2
Caddy admin /config endpoint and its authorization middleware
Deployments exposing the Caddy admin API to multiple authorized principals

Discovery Timeline

2026-06-23 - CVE-2026-45692 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-45692

Vulnerability Analysis

Caddy exposes a /config administrative API that allows callers to read and mutate configuration objects through path-based addressing. Caddy gates access to this API with an authorization layer that matches request paths against allowed prefixes. The traversal layer that resolves the request to an actual configuration object uses a different parsing strategy. The authorization check treats paths as opaque strings, while traversal decodes array indices through strconv.Atoi(). Numeric forms such as 01, +1, and 1 compare as distinct strings but resolve to the same array index. An attacker can craft a path that passes the prefix check for one object yet dereferences a different object during traversal.

Root Cause

The root cause is a parser differential between two layers that must agree on the meaning of a path. String prefix matching in the authorization layer does not normalize numeric segments. The traversal layer in contrast canonicalizes those segments through integer conversion. The two layers therefore answer the same authorization question differently, which violates the assumption that an authorized path and a traversed path refer to the same object [CWE-187].

Attack Vector

An attacker needs network reachability to the Caddy admin API and low-privileged credentials that authorize at least one config path. The attacker submits an HTTP request to /config/... with an array index encoded in a form that the authorization prefix accepts but that strconv.Atoi() resolves to a different index. The request bypasses the intended scope and reads or modifies a configuration object outside the authorized boundary. No user interaction is required. The vulnerability mechanism is described in the Caddy GitHub Security Advisory.

Detection Methods for CVE-2026-45692

Indicators of Compromise

Requests to /config/ paths containing numeric segments with leading zeros, plus signs, or whitespace such as /config/apps/http/servers/01/...
Successful 2xx responses on admin API paths that the requesting principal is not scoped to manage
Configuration drift in Caddy objects that were not modified by an authorized change workflow

Detection Strategies

Log every request to the Caddy admin API with full path, method, principal, and response status, then alert on numeric segments that are not in canonical decimal form
Compare the authorization-layer path against the resolved object identifier and flag mismatches
Diff running Caddy configuration against the version-controlled source of truth on a schedule

Monitoring Recommendations

Forward Caddy admin API access logs to a centralized log platform and retain them for incident review
Baseline expected callers and paths for the admin API, then alert on deviations
Monitor outbound changes to TLS, routing, and reverse-proxy configuration objects, since these are high-value targets for an attacker who escapes their authorized scope

How to Mitigate CVE-2026-45692

Immediate Actions Required

Upgrade Caddy to version 2.11.3 or later on every host that exposes the admin API
Restrict the admin API listener to loopback or an internal management network until patching is complete
Rotate any admin API credentials or tokens that may have been used during the exposure window
Audit current Caddy configuration against the expected baseline to identify unauthorized changes

Patch Information

The vulnerability is fixed in Caddy 2.11.3. Patch details and the full advisory are available in the Caddy GitHub Security Advisory GHSA-x5w9-xh9r-mvfc.

Workarounds

Bind the Caddy admin endpoint to 127.0.0.1 and require an authenticated reverse proxy or SSH tunnel for any remote management
Place a front-end proxy in front of the admin API that rejects paths containing non-canonical numeric segments such as leading zeros or sign characters
Reduce the number of principals authorized to call /config and grant only the minimum prefix scope each role requires

bash

# Configuration example: restrict Caddy admin API to loopback
{
  admin 127.0.0.1:2019
}