Cyber Resilience

CVE-2026-45692

Access Control in Caddyserver Caddy 2.4.0 – 2.11.3

Public PoCAccess Control
Published
23 June 2026
Modified
26 June 2026
Patch / advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0017 6th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-45692 is a medium-severity Partial String Comparison (CWE-187) vulnerability in Caddyserver Caddy. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

No EU or UK CSIRT advisories indexed for this CVE.

Vulnerability Data

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for…

more

one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Authorization bypass in public-facing Caddy server config API directly enables exploitation of the application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-27586Same product: Caddyserver Caddy
CVE-2026-27590Same product: Caddyserver Caddy
CVE-2026-27587Same product: Caddyserver Caddy
CVE-2026-52845Same product: Caddyserver Caddy
CVE-2026-27588Same product: Caddyserver Caddy
CVE-2026-27589Same product: Caddyserver Caddy
CVE-2026-45135Same product: Caddyserver Caddy
CVE-2026-27585Same product: Caddyserver Caddy
CVE-2026-52846Same product: Caddyserver Caddy
CVE-2026-30851Same product: Caddyserver Caddy

Affected Assets

caddyserver
caddy
2.4.0 — 2.11.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.4.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authorization decisions on the resolved config object rather than a mismatched string prefix.

prevent

Requires consistent validation and canonicalization of path inputs before authorization or traversal occurs.

prevent

Limits privileges on the /config endpoint so that even a bypassed path yields minimal access.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent unsafe string comparisons by enforcing proper API usage and testing.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover partial-comparison flaws during code or binary analysis.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect and prevent partial string comparison flaws before deployment.

prevents

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

prevents

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

prevents

Secure development lifecycle practices can include requirements to avoid partial string comparisons in authentication or validation logic.

prevents

Application security requirements can mandate full, exact comparisons for sensitive operations.

degrades

Secure system architecture principles discourage unsafe partial comparisons in critical paths.

References