CVE-2026-52844: Caddy Auth Bypass Vulnerability

CVE-2026-52844 Overview

CVE-2026-52844 is a path traversal vulnerability in Caddy, an extensible TLS-enabled server platform. On Windows hosts, Caddy path matchers treat /private\secret.txt as outside the /private/* scope. However, the file_server module later resolves the same request path as private\secret.txt on disk. This inconsistency lets an unauthenticated remote client bypass path-scoped authentication and deny routes that protect /private/*. The flaw affects all Caddy versions prior to 2.11.4 running on Windows. The issue is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated attackers can read files in directories protected by Caddy path matchers when Caddy runs on Windows.

Affected Products

Caddy server on Windows, all versions prior to 2.11.4
Deployments using path-scoped auth or deny routes such as /private/*
Configurations combining path matchers with the file_server directive

Discovery Timeline

2026-06-23 - CVE-2026-52844 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-52844

Vulnerability Analysis

The vulnerability stems from inconsistent path normalization between Caddy's request matching layer and its file resolution layer on Windows. Path matchers compare the request URI against a configured pattern such as /private/*. A request to /private\secret.txt contains a backslash, which the matcher treats as a literal character rather than a directory separator. The matcher therefore concludes the request falls outside the protected scope and skips the associated auth or deny directives.

The file_server module then receives the request and translates the URI into a filesystem path. Windows treats both / and \ as valid directory separators. The file server resolves the request to private\secret.txt on disk and returns the file contents. The result is an authentication bypass that exposes protected static content to unauthenticated clients.

Root Cause

The root cause is divergent path interpretation across Caddy components on Windows. Matchers operate on the raw URI string, while the file server delegates to the Windows filesystem, which normalizes backslashes as separators. The two layers reach different conclusions about which directory a request targets.

Attack Vector

A remote, unauthenticated attacker sends an HTTP request where directory separators in a protected path are replaced with URL-encoded or literal backslashes. The matcher fails to recognize the protected prefix, the route stack omits authentication, and the file server retrieves the file from disk. No user interaction or privileges are required.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-qrp7-cvwr-j2c6 for vendor-provided technical details.

Detection Methods for CVE-2026-52844

Indicators of Compromise

HTTP access log entries containing backslash characters or %5C sequences in request paths targeting protected prefixes such as /private
Successful 200 OK responses for resources under protected directories without preceding authentication events
Requests to file_server endpoints where the URI mixes forward slashes and backslashes

Detection Strategies

Parse Caddy access logs for requests containing \ or %5C immediately following a protected path prefix
Correlate file-server response events with the absence of matching authentication log entries for the same client and request ID
Compare matcher evaluation traces against file resolution results in debug logs to surface inconsistent path handling

Monitoring Recommendations

Forward Caddy access and error logs to a centralized log platform with alerting on suspicious encoded separator patterns
Track the running Caddy version on Windows hosts and alert on any instance below 2.11.4
Monitor unusual read activity against directories meant to be access-controlled by Caddy routes

How to Mitigate CVE-2026-52844

Immediate Actions Required

Upgrade all Windows Caddy instances to version 2.11.4 or later
Audit Caddyfiles and JSON configurations for path-scoped auth, basicauth, and deny directives that protect file_server content
Review historical access logs for backslash-containing requests against protected paths to identify prior exploitation attempts

Patch Information

The Caddy maintainers fixed the issue in version 2.11.4. Patched builds normalize backslash characters in request paths before matcher evaluation on Windows, ensuring matchers and file_server resolve the same logical path. Refer to the GitHub Security Advisory GHSA-qrp7-cvwr-j2c6 for release notes and commit references.

Workarounds

Host Caddy on Linux or other non-Windows operating systems where the filesystem does not treat \ as a separator
Place a reverse proxy or web application firewall in front of Caddy that rejects requests containing backslash characters or %5C in the path
Restrict filesystem permissions on sensitive directories so the Caddy process account cannot read them, removing reliance on path-scoped matchers for confidentiality

bash

# Configuration example: block backslash-containing request paths at an upstream proxy
# nginx fronting Caddy on Windows
location / {
    if ($request_uri ~* "\\\\|%5C") {
        return 400;
    }
    proxy_pass http://caddy_backend;
}