Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-45692 is a medium-severity Partial String Comparison (CWE-187) vulnerability in Caddyserver Caddy. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
No EU or UK CSIRT advisories indexed for this CVE.
Vulnerability Data
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for…
more
one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in public-facing Caddy server config API directly enables exploitation of the application.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization decisions on the resolved config object rather than a mismatched string prefix.
Requires consistent validation and canonicalization of path inputs before authorization or traversal occurs.
Limits privileges on the /config endpoint so that even a bypassed path yields minimal access.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.
Secure SDLC practices directly prevent unsafe string comparisons by enforcing proper API usage and testing.
Vulnerability identification processes can discover partial-comparison flaws during code or binary analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect and prevent partial string comparison flaws before deployment.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.
Secure development lifecycle practices can include requirements to avoid partial string comparisons in authentication or validation logic.
Application security requirements can mandate full, exact comparisons for sensitive operations.
Secure system architecture principles discourage unsafe partial comparisons in critical paths.