CVE-2026-27589: caddyserver caddy Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2026-27589 is a medium (CVSS 6.9) Cross-Site Request Forgery (CSRF) vulnerability in caddyserver caddy. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.3% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-02-2026
   PublishedVulnerability first disclosed.
2. 27-02-2026
   Last modifiedVulnerability information updated.

Description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.