CVE-2026-27589: Caddy vulnerable to cross-origin config application via local admin API /load (caddy)
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27589?
CVE-2026-27589 is considered a medium severity vulnerability due to its potential for state changes in configuration without proper origin enforcement.
How do I fix CVE-2026-27589?
To fix CVE-2026-27589, upgrade to Caddy version 2.11.1 or later to ensure the local admin API is secured.
What parts of Caddy are affected by CVE-2026-27589?
CVE-2026-27589 affects Caddy versions prior to 2.11.1, specifically impacting the local Caddy admin API.
What is the impact of CVE-2026-27589?
The impact of CVE-2026-27589 allows unauthorized users to change the running configuration if origin enforcement is not enabled.
Is Origin Enforcement relevant to CVE-2026-27589?
Yes, origin enforcement is crucial in mitigating the risks associated with CVE-2026-27589 by preventing unauthorized POST requests.