CVE-2026-27587
Caddyserver Caddy 2.10.2 – 2.11.1
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-27587 is a high-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Caddyserver Caddy. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27587 affects Caddy, an extensible server platform that uses TLS by default, specifically in versions prior to 2.11.1. The vulnerability lies in the HTTP `path` request matcher, which is intended to perform case-insensitive matching. However, when the match pattern includes percent-escape sequences (`%xx`), it compares against the request's escaped path without lowercasing the pattern. This inconsistency (classified under CWE-178: Improper Handling of Case Sensitivity) enables attackers to bypass path-based routing configurations and associated access controls by manipulating the casing of the request path. The issue carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high confidentiality and integrity impacts.
Any unauthenticated attacker with network access to a vulnerable Caddy instance can exploit this flaw remotely with low complexity and no user interaction required. By crafting HTTP requests where the path uses percent-encoded characters and varies the case (e.g., mixing uppercase and lowercase letters in the path), the attacker can evade intended route matching. This allows access to protected resources, potentially exposing sensitive data (high confidentiality impact) or enabling unauthorized modifications (high integrity impact), such as reaching administrative endpoints or private files gated by path-specific rules.
The official mitigation is to upgrade to Caddy version 2.11.1 or later, which includes a fix for proper lowercasing in path matching with percent-escapes. Details are available in the Caddy release notes at https://github.com/caddyserver/caddy/releases/tag/v2.11.1 and the security advisory at https://github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jh, which confirm the patch resolves the bypass without additional workarounds recommended.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8542
Vulnerability Data
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped…
more
path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Applying access control decisions to each request depends on accurate property determination that accounts for case differences.
Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC practices should include case-sensitivity requirements in design and coding standards.
Application security requirements must specify case handling for identifiers and paths.
Architecture principles should enforce canonical, case-aware resource naming.
Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.
Access-control rules that ignore case can allow unintended resource access.
Authentication logic must treat identifiers consistently to avoid bypass via case differences.