Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-27589 is a vulnerability in the Caddy web server's local admin API, specifically in the POST /load endpoint that replaces the entire running configuration."}, {'type': 'paragraph', 'content': "By default, the admin API listens on 127.0.0.1:2019 and does not enforce origin checks (enforce_origin is not enabled). This allows attacker-controlled web content running in a victim's browser or an untrusted local client to send cross-origin POST requests to the /load endpoint."}, {'type': 'paragraph', 'content': 'Because the /load endpoint accepts and applies attacker-supplied JSON configuration data without proper verification, an attacker can arbitrarily modify the running Caddy configuration. This includes changing admin listener settings and altering HTTP server behavior without user consent.'}, {'type': 'paragraph', 'content': 'The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue due to insufficient verification that requests are intentionally made by the user.'}, {'type': 'paragraph', 'content': 'A fix was introduced in Caddy version 2.11.1 by enabling origin enforcement or requiring unguessable tokens for state-changing admin endpoints to prevent unauthorized cross-origin requests.'}] [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a high-severity impact on the integrity of your Caddy server configuration.

An attacker who exploits this vulnerability can change the running configuration of your Caddy server without your knowledge or consent.

• They can modify admin listener settings, potentially moving the admin API to a new address.
• They can alter HTTP server behavior, such as changing routes and responses.

Such unauthorized changes can lead to loss of control over the server, unauthorized access, or disruption of service.

Exploitation requires that the victim is running a vulnerable Caddy version with the admin API enabled and either visits an attacker-controlled web page or an untrusted local client issues a request.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by verifying if the Caddy server's local admin API is running and listening on the default address 127.0.0.1:2019 and if the origin enforcement is disabled (enforce_origin not configured)."}, {'type': 'paragraph', 'content': 'One approach is to check if the /load endpoint accepts cross-origin POST requests that replace the running configuration without proper origin checks.'}, {'type': 'paragraph', 'content': 'A proof-of-concept (PoC) includes scripts to verify the vulnerability by sending POST requests with attacker-controlled origin headers to the /load endpoint and observing if the configuration changes are applied.'}, {'type': 'list_item', 'content': 'Check if Caddy admin API is listening on 127.0.0.1:2019 (e.g., using netstat or ss): `netstat -tuln | grep 2019`'}, {'type': 'list_item', 'content': 'Attempt to fetch current configuration: `curl http://127.0.0.1:2019/config/`'}, {'type': 'list_item', 'content': 'Test POST request to /load endpoint with a crafted JSON config and an attacker-controlled Origin header to see if the server accepts and applies it.'}, {'type': 'list_item', 'content': 'Use provided PoC scripts (e.g., `make verify` in the extracted poc.zip) to automate detection and verification of the vulnerability.'}] [1, 2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enabling origin enforcement on the Caddy admin API to prevent cross-origin requests from unauthorized sources.

Specifically, configure the admin API to enforce origin checks for unsafe HTTP methods like POST, which prevents attacker-controlled web content from sending malicious configuration changes.

Alternatively or additionally, require an unguessable token for the /load endpoint and other state-changing admin endpoints to restrict access.

Upgrading Caddy to version 2.11.1 or later, where this vulnerability is fixed, is strongly recommended.

Useful 0 Not Useful 0