Caddy
CVE-2026-27587
CRITICAL
GHSA-g7pc-pc7g-h8jh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTTP request with mixed-case percent-encoded path
-
ExploitBypass case-insensitive path matcher
-
ExecutionAccess restricted routes
-
ImpactCircumvent access controls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Case sensitivity handling
|
| Exploitation Conditions | Caddy versions prior to 2.11.1 with HTTP path matcher containing percent-escape sequences (%xx) in routing rules. No authentication required; remote unauthenticated exploitation against default Caddy configurations using case-sensitive path-based access controls. |
| Impact | CVSS 9.1. Path-based access controls in Caddy can be bypassed on Windows and macOS filesystems. |
| Exploit ScenarioDerived | Attacker requests /Admin instead of /admin on case-insensitive filesystem, Caddy's path rule doesn't match, access control is bypassed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using alternate casing on case-insensitive filesystems. PoC available.
Earlier versions of this analysis (1)
Path matching case sensitivity bypass in Caddy.
RemediationAI
Update to Caddy 2.11.1. Use case-insensitive matching or normalize request paths.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-178 improper handling of case sensitivity. Caddy's path matcher is case-sensitive but the underlying filesystem may be case-insensitive, allowing access control bypass.
Know when Caddy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (%xx) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Executive ViewAI
A critical vulnerability in Caddy web servers (CVE-2026-27587) allows attackers to bypass path-based access controls through case-sensitivity mishandling in URL encoding, potentially exposing sensitive endpoints and data. Organizations running Caddy versions prior to 2.11.1 face immediate risk of unauthorized access to protected resources, particularly those relying on path matching for security enforcement.
Deploy WAF with URL normalization rules to lowercase and validate percent-encoded paths before forwarding to Caddy; implement reverse proxy with strict path validation ahead of Caddy; disable HTTP path matcher functionality if not critical to operations; use allowlist-based access controls instead of path matching where possible; apply network segmentation to limit exposure of protected endpoints; implement real-time monitoring and alerting for suspicious path traversal patterns; consider temporary deployment of request filtering to reject malformed or suspicious URL encoding.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to
TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in Cli
Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casi
Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e
Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers
A configuration-gated information-disclosure flaw in Caddy 2.11.3 and earlier allows an unauthenticated remote attacker
Caddy versions prior to 2.11.1 fail to sanitize backslashes in file path matching, allowing attackers to bypass path-bas
Caddy versions prior to 2.11.1 allow unauthenticated cross-origin requests to the admin API when origin enforcement is d
An issue was discovered in caddy (for TYPO3) before 7.2.10. Rated medium severity (CVSS 6.1), this vulnerability is remo
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumer
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB