| CVE-2026-55458 | LOW | Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through | 28/10/2026 |
| CVE-2026-77281 | MEDIUM6.5 | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a seco | 17/09/2026 |
| GO-2026-5730 | — | Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy | 24/07/2026 |
| GO-2026-5408 | — | Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy | 24/07/2026 |
| CVE-2026-52846 | MEDIUM4.2 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the o | 23/06/2026 |
| CVE-2026-52845 | HIGH8.1 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by r | 23/06/2026 |
| CVE-2026-52844 | HIGH7.5 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny r | 23/06/2026 |
| CVE-2026-45692 | LOW3.8 | Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during trave | 23/06/2026 |
| CVE-2026-45135 | HIGH8.1 | Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback l | 23/06/2026 |
| GHSA-gx7w-56w6-g48x | MEDIUM4.3 | Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching | 19/05/2026 |
| GHSA-wwhq-w58m-w29c | MEDIUM | Caddy CVE-2026-30852 Fix Bypass | 19/05/2026 |
| CVE-2026-30852 | HIGH7.5 | Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets r | 07/03/2026 |
| CVE-2026-30851 | HIGH8.8 | Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2. | 07/03/2026 |
| CVE-2026-27590 | CRITICAL9.8 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF | 24/02/2026 |
| CVE-2026-27589 | MEDIUM6.5 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), t | 24/02/2026 |
| CVE-2026-27588 | CRITICAL9.1 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routin | 24/02/2026 |
| CVE-2026-27587 | CRITICAL9.1 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypas | 24/02/2026 |
| CVE-2026-27586 | CRITICAL9.1 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but acc | 24/02/2026 |
| CVE-2026-27585 | MEDIUM6.5 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes th | 24/02/2026 |
| CVE-2022-28923 | MEDIUM6.1 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. | 06/02/2023 |