GHSA-879p-475x-rqh2

Suggest an improvement
Source
https://github.com/advisories/GHSA-879p-475x-rqh2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-879p-475x-rqh2/GHSA-879p-475x-rqh2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-879p-475x-rqh2
Aliases
Downstream
Published
2026-02-24T20:37:35Z
Modified
2026-02-27T19:54:36Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Caddy is vulnerable to cross-origin config application via local admin API /load
Details

commit: e0f8d9b2047af417d8faf354b675941f3dac9891 (as-of 2026-02-04) channel: GitHub security advisory (per SECURITY.md)

summary

The local caddy admin API (default listen 127.0.0.1:2019) exposes a state-changing POST /load endpoint that replaces the entire running configuration.

When origin enforcement is not enabled (enforce_origin not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. this can change the admin listener settings and alter HTTP server behavior without user intent.

Severity

Medium

Justification:

  • The attacker can apply an arbitrary caddy config (integrity impact) by driving a victim’s local admin API.
  • Exploitation requires a victim running caddy with the admin API enabled and visiting an attacker-controlled page (or otherwise issuing the request from an untrusted local client).

Affected component

Reproduction

Attachment: poc.zip (integration harness) with canonical and control runs.

unzip -q -o poc.zip -d poc
cd poc/poc-F-CADDY-ADMIN-LOAD-001
make test

Expected output (excerpt):

[CALLSITE_HIT]: adminLoad.handleLoad
[PROOF_MARKER]: http_code=200 admin_moved=true response_pwned=true

Control output (excerpt):

[NC_MARKER]: http_code=403 load_blocked=true admin_moved=false response_pwned=false

Impact

An attacker can replace the running caddy configuration via the local admin API. Depending on the deployed configuration/modules, this can:

  • Change admin listener settings (e.g., move the admin listener to a new address)
  • Change HTTP server behavior (e.g., alter routes/responses)

Suggested remediation

Ensure cross-origin web content cannot trigger POST /load on the local admin API by default, for example by:

  • Enabling origin enforcement by default for unsafe methods, and/or
  • Requiring an unguessable token for /load (and other state-changing admin endpoints).

poc.zip PR_DESCRIPTION.md

Database specific 
{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-24T20:37:35Z",
    "nvd_published_at":  "2026-02-24T17:29:04Z",
    "severity":  "MODERATE"
}
References

Affected packages

Go / github.com/caddyserver/caddy/v2

Package

Name
github.com/caddyserver/caddy/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/caddyserver/caddy/v2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.11.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-879p-475x-rqh2/GHSA-879p-475x-rqh2.json"