CVE-2026-92700: Caddy Server Auth Bypass Vulnerability

CVE-2026-92700 Overview

CVE-2026-92700 affects the Caddy web server, an extensible HTTP/HTTPS platform that enables TLS by default. The vulnerability resides in the file server module (modules/caddyhttp/fileserver/staticfiles.go), where the fileHidden() function performs case-sensitive matching using filepath.Match. On case-insensitive filesystems, or when mixed-case paths coexist, attackers can request case variants of hidden filenames to bypass the hide directive. This exposes files that administrators explicitly configured Caddy to conceal. Versions 2.11.3 and earlier are affected. The weakness is classified as [CWE-178] Improper Handling of Case Sensitivity.

Critical Impact
Remote unauthenticated attackers can retrieve files intended to be hidden by Caddy's file server, including configuration files, credentials, or source artifacts stored alongside served content.

Affected Products

Caddy web server versions 2.11.3 and earlier
Deployments serving files from case-insensitive filesystems (Windows NTFS, macOS HFS+/APFS default)
Any Caddy configuration using the hide directive in the file_server module

Discovery Timeline

2026-09-23 - CVE-2026-92700 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-92700

Vulnerability Analysis

Caddy's file_server module supports a hide directive that lists path patterns the server should refuse to serve. The fileHidden() function in modules/caddyhttp/fileserver/staticfiles.go evaluates each request path against these patterns using Go's filepath.Match. That function performs byte-for-byte, case-sensitive comparison. When the underlying filesystem resolves paths case-insensitively, an attacker can request /Config.Json and receive the same file that /config.json would return, but bypass a hide rule that only matches the lowercase form. The result is disclosure of files the operator intended to protect.

Root Cause

The root cause is a semantic mismatch between the matching logic and the filesystem's resolution behavior. Caddy compares the requested path to hide patterns with case sensitivity, while the operating system opens the file with case-insensitive lookup. Any file whose canonical name matches a hide pattern remains reachable through a differently cased variant. This is a classic [CWE-178] Improper Handling of Case Sensitivity flaw.

Attack Vector

Exploitation requires only network access to a vulnerable Caddy instance serving static files with hide rules on a case-insensitive filesystem. The attacker crafts an HTTP GET request that changes the case of one or more characters in the hidden filename. Caddy's hide check returns false, and the file server proceeds to open and stream the file to the client. No authentication or user interaction is required.

See the GitHub Security Advisory GHSA-j8px-rmrx-76h9 for technical details.

Detection Methods for CVE-2026-92700

Indicators of Compromise

HTTP access log entries requesting mixed-case variants of filenames listed in Caddy hide directives
Successful 200 responses for paths that normally return 404 under case-normalized requests
Repeated requests iterating through case permutations of sensitive filenames such as .env, config.json, or .git/config

Detection Strategies

Review Caddy access logs for requests targeting configured hidden paths with non-canonical casing
Compare the case of served URIs against the exact strings in the Caddyfile hide directive and alert on divergence
Deploy a reverse proxy or WAF rule that normalizes request paths to lowercase before they reach Caddy on case-insensitive hosts

Monitoring Recommendations

Ingest Caddy access and error logs into a centralized log platform and build queries for anomalous casing patterns on protected paths
Alert on outbound transfer of files whose canonical names appear in hide configuration
Track the version of Caddy binaries across the fleet to identify unpatched instances still running 2.11.3 or earlier

How to Mitigate CVE-2026-92700

Immediate Actions Required

Upgrade Caddy to a version later than 2.11.3 that includes the case-insensitive hide-matching fix
Audit all hide directives and confirm the target files are not otherwise reachable through variant paths
Move sensitive configuration and credential files outside the document root served by file_server

Patch Information

The Caddy maintainers addressed the flaw in a release following 2.11.3. Refer to the GitHub Security Advisory GHSA-j8px-rmrx-76h9 for the fixed version and commit references. Apply the upgrade before restoring service on Windows or macOS hosts where the filesystem is case-insensitive.

Workarounds

Host Caddy on a case-sensitive filesystem such as ext4 or XFS on Linux, which reduces exposure to case-variant requests
Relocate files that must remain hidden outside directories exposed by file_server roots
Front Caddy with a proxy that lowercases request paths before forwarding, so hide patterns match consistently

bash

# Configuration example: upgrade and verify Caddy version
caddy version
# If output shows v2.11.3 or earlier, upgrade:
#   Debian/Ubuntu: sudo apt update && sudo apt install --only-upgrade caddy
#   Container:     docker pull caddy:latest && docker compose up -d
caddy validate --config /etc/caddy/Caddyfile
sudo systemctl restart caddy