ALPINE-CVE-2026-27589
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-27589
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-27589.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-27589
- Upstream
- Published
- 2026-02-24T17:29:04Z
- Modified
- 2026-11-03T06:33:02Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen
127.0.0.1:2019) exposes a state-changingPOST /loadendpoint that replaces the entire running configuration. When origin enforcement is not enabled (enforce_originnot configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue. - References