ID
VAR-202602-2870
CVE
CVE-2026-27589
TITLE
Light Code Labs of Caddy Cross-site request forgery vulnerability in
Trust: 0.8
DESCRIPTION
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue. HTTP You can change the server's behavior. 2.11.1 contains a fix for this issue.There is no risk of information being leaked to the outside world regarding the information handled by the software. However, there is a possibility that all information handled by the software may be rewritten. Furthermore, the software will not shut down. Furthermore, attacks that exploit this vulnerability will not affect other software
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | caddyserver | model: | caddy | scope: | lt | version: | 2.11.1 | Trust: 1.0 |
| vendor: | light code | model: | caddy | scope: | eq | version: | 2.11.1 | Trust: 0.8 |
| vendor: | light code | model: | caddy | scope: | - | version: | - | Trust: 0.8 |
| vendor: | light code | model: | caddy | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-352 | Trust: 1.0 |
| problemtype: | Cross-site request forgery (CWE-352) [ others ] | Trust: 0.8 |
PATCH
| title: | cross-origin config application via local admin API /load (caddy) Advisory caddyserver/caddy GitHub (PR_DESCRIPTION.md) GitHub Advisory Database | url: | https://github.com/user-attachments/files/25079820/PR_DESCRIPTION.md | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2026-27589 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2026-005157 | Trust: 0.8 |
REFERENCES
| url: | https://github.com/user-attachments/files/25079818/poc.zip | Trust: 1.8 |
| url: | https://github.com/caddyserver/caddy/releases/tag/v2.11.1 | Trust: 1.8 |
| url: | https://github.com/user-attachments/files/25079820/pr_description.md | Trust: 1.0 |
| url: | https://github.com/caddyserver/caddy/security/advisories/ghsa-879p-475x-rqh2 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2026-27589 | Trust: 0.8 |
SOURCES
| db: | JVNDB | id: | JVNDB-2026-005157 |
| db: | NVD | id: | CVE-2026-27589 |
LAST UPDATE DATE
2026-02-28T23:57:27.212000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2026-005157 | date: | 2026-02-27T03:42:00 |
| db: | NVD | id: | CVE-2026-27589 | date: | 2026-02-25T17:08:56.040 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2026-005157 | date: | 2026-02-27T00:00:00 |
| db: | NVD | id: | CVE-2026-27589 | date: | 2026-02-24T17:29:04.317 |