CVE-2026-27589: Caddy vulnerable to cross-origin config application via local admin API /load (caddy)
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen 127.0.0.1:2019) exposes a state-changing POST /load endpoint that replaces the entire running configuration. When origin enforcement is not enabled (enforceorigin not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.
Other sources
commit: e0f8d9b2047af417d8faf354b675941f3dac9891 (as-of 2026-02-04) channel: GitHub security advisory (per SECURITY.md)
summary
The local caddy admin API (default listen 127.0.0.1:2019) exposes a state-changing POST /load endpoint that replaces the entire running configuration.
When origin enforcement is not enabled (enforceorigin not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. this can change the admin listener settings and alter HTTP server behavior without user intent.
Severity
Medium
Justification: - The attacker can apply an arbitrary caddy config (integrity impact) by driving a victim’s local admin API. - Exploitation requires a victim running caddy with the admin API enabled and visiting an attacker-controlled page (or otherwise issuing the request from an untrusted local client).
Affected component
- caddyconfig/load.go: adminLoad.handleLoad (/load admin endpoint) - Pinned callsite: https://github.com/caddyserver/caddy/blob/e0f8d9b2047af417d8faf354b675941f3dac9891/caddyconfig/load.go#L73
Reproduction
Attachment: poc.zip (integration harness) with canonical and control runs.
bash unzip -q -o poc.zip -d poc cd poc/poc-F-CADDY-ADMIN-LOAD-001 make test
Expected output (excerpt):
[CALLSITEHIT]: adminLoad.handleLoad [PROOFMARKER]: httpcode=200 adminmoved=true responsepwned=true
Control output (excerpt):
[NCMARKER]: httpcode=403 loadblocked=true adminmoved=false responsepwned=false
Impact
An attacker can replace the running caddy configuration via the local admin API. Depending on the deployed configuration/modules, this can: - Change admin listener settings (e.g., move the admin listener to a new address) - Change HTTP server behavior (e.g., alter routes/responses)
Suggested remediation
Ensure cross-origin web content cannot trigger POST /load on the local admin API by default, for example by: - Enabling origin enforcement by default for unsafe methods, and/or - Requiring an unguessable token for /load (and other state-changing admin endpoints).
poc.zip PRDESCRIPTION.md
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27589?
CVE-2026-27589 is considered a medium severity vulnerability due to its potential for state changes in configuration without proper origin enforcement.
How do I fix CVE-2026-27589?
To fix CVE-2026-27589, upgrade to Caddy version 2.11.1 or later to ensure the local admin API is secured.
What parts of Caddy are affected by CVE-2026-27589?
CVE-2026-27589 affects Caddy versions prior to 2.11.1, specifically impacting the local Caddy admin API.
What is the impact of CVE-2026-27589?
The impact of CVE-2026-27589 allows unauthorized users to change the running configuration if origin enforcement is not enabled.
Is Origin Enforcement relevant to CVE-2026-27589?
Yes, origin enforcement is crucial in mitigating the risks associated with CVE-2026-27589 by preventing unauthorized POST requests.