CVE-2026-45692: Caddy Configuration Path Traversal via Authorization Bypass

Technical summary

The vulnerability stems from inconsistent path resolution between the authorization layer and the `/config` API traversal layer in Caddy. The authorization system performs string prefix matching to validate access control, while the `/config` endpoint uses Go's `strconv.Atoi()` to parse array indices as integers during object resolution. This semantic mismatch allows an authenticated user to construct requests that pass authorization checks but resolve to unintended configuration objects. For instance, authorization might whitelist `/config/servers/0`, but a crafted request could resolve that same string to access `/config/servers/1` due to how the traversal logic interprets the numeric component. The issue affects all Caddy versions from 2.4.0 through 2.11.2 and is resolved in version 2.11.3, where the authorization and traversal layers now agree on path semantics.

Business impact

This vulnerability could lead to unauthorized disclosure of sensitive configuration data, such as API credentials, TLS certificates, upstream server addresses, and middleware settings stored in Caddy's configuration. In multi-tenant or role-based scenarios, it enables privilege escalation within a single Caddy instance. The impact is limited by the authentication requirement—only users with existing API access can exploit it. However, for organizations using Caddy in shared environments or exposing the `/config` API to internal tools or microservices, the ability to read unintended configuration objects represents a meaningful confidentiality and integrity risk. No denial of service or remote code execution is possible through this vector.

Affected systems

Caddy versions 2.4.0 through 2.11.2 are affected. The vulnerability is present in the core Caddy server platform and affects any deployment exposing the `/config` API endpoint with authentication enabled. Risk is highest in scenarios where the `/config` API is used programmatically by internal services, CI/CD pipelines, or management tools, or where multiple users have different permission levels on the same Caddy instance. Caddy 2.11.3 and later versions contain the fix.

Exploitability

Exploitation requires valid credentials and network access to the `/config` endpoint. The attack is straightforward once authenticated: an attacker need only craft HTTP requests using the path traversal technique to probe and access unintended configuration objects. No special tools, zero-day techniques, or race conditions are required. The CVSS score of 5.4 (MEDIUM) reflects the need for prior authentication and the restriction to information disclosure and limited integrity impact. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept or active exploitation has been reported.

Remediation

Upgrade Caddy to version 2.11.3 or later immediately. The fix ensures that both the authorization and traversal layers use identical path resolution semantics, eliminating the mismatch. Organizations unable to upgrade immediately should restrict network access to the `/config` API endpoint using firewall rules or reverse proxy authentication, limiting exposure to trusted internal networks only. Review logs for suspicious `/config` API requests from authenticated users, particularly those accessing unexpected array indices or configuration objects outside their assigned scope.

Patch guidance

Apply Caddy 2.11.3 as soon as practically feasible. Verify the patch by checking the running version with `caddy version` or via the `/metrics` endpoint. No configuration changes are required post-upgrade; the fix is transparent. For users managing Caddy via package managers, ensure you pull updates from official repositories. If using Docker, update the base image or tag to a version containing Caddy 2.11.3 or later. Test in a staging environment before production deployment to confirm compatibility with any custom plugins or middleware.

Detection guidance

Monitor for suspicious `/config` API requests originating from authenticated users, particularly those attempting to access configuration indices or paths outside expected patterns. Look for repeated requests with varying array indices (e.g., `/config/servers/0`, `/config/servers/1`, `/config/servers/2`) that deviate from normal operational patterns. Enable debug logging on the `/config` endpoint if available and correlate authorization denials with successful subsequent requests to different objects. Check Caddy's access logs for authentication failures followed immediately by requests that succeed in accessing sensitive configuration data.

Why prioritize this

This vulnerability merits prompt attention despite its MEDIUM severity rating. The root cause—a fundamental disagreement in path interpretation between security and functional layers—is a systemic issue that undermines the integrity of access control. While exploitation requires authentication, insider threats or compromised service accounts could abuse this flaw to escalate privileges or discover credentials. For organizations relying on Caddy's configuration API in automated workflows, this represents a supply chain-like risk. Patching is straightforward, making remediation friction minimal. Organizations should treat this as HIGH priority within their authenticated-access vulnerability queue.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: (1) network-accessible attack vector with low complexity; (2) requirement for low-privilege authentication, reducing unauthenticated risk; (3) confidentiality and integrity impact limited to configuration data rather than the underlying system; (4) no availability impact. The score appropriately captures a flaw that threatens configuration secrecy and consistency within a trusted boundary, but does not enable system compromise or denial of service.

Frequently asked questions