Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy

Description

References

• caddyserver/caddy security advisory · ADVISORY

github.com/caddyserver/caddy/v2 的其他漏洞

• CVE-2026-55458低危Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
• CVE-2026-77281中危 6.5Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses aff…
• GO-2026-5730Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
• CVE-2026-52846中危 4.2Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove…
• CVE-2026-52845高危 8.1Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplie…