CVE-2026-45692— Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45692
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Source: NVD (National Vulnerability Database)
Vulnerability Description
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
部分比较
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| caddyserver | caddy | >= 2.4.0, < 2.11.3 | - |
II. Public POCs for CVE-2026-45692
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45692
请登录查看更多情报信息。
Other References for CVE-2026-45692 (1)
Same Patch Batch · caddyserver · 2026-06-23 · 5 CVEs total
| CVE-2026-45135 | 8.1 HIGH | Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files |
| CVE-2026-52845 | 8.1 HIGH | Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` |
| CVE-2026-52844 | 7.5 HIGH | Caddy: Windows `file_server` path authorization bypass via encoded backslash |
| CVE-2026-52846 | 4.2 MEDIUM | Caddy: stripHTML template function bypass |
IV. Related Vulnerabilities
Same product: caddy
- CVE-2026-45135
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Ex - CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth - CVE-2026-52844
Caddy: Windows `file_server` path authorization bypass via e - CVE-2026-52846
Caddy: stripHTML template function bypass - CVE-2026-30851
Caddy forward_auth copy_headers Does Not Strip Client-Suppli
Same vendor: caddyserver
- CVE-2026-45135
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Ex - CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth - CVE-2026-52844
Caddy: Windows `file_server` path authorization bypass via e - CVE-2026-52846
Caddy: stripHTML template function bypass - CVE-2026-30851
Caddy forward_auth copy_headers Does Not Strip Client-Suppli
Same weakness: CWE-187
- CVE-2026-44837
view_component: System Test Entry Point Path Check Allows Si - CVE-2026-34785
Rack: Local file inclusion in `Rack::Static` via URL Prefix - CVE-2026-30874
OpenWrt procd PATH Environment Variable Filter Bypass via In - CVE-2025-23384
Siemens RUGGEDCOM和Siemens SCALANCE 缓冲区错误漏洞 - CVE-2024-41110
Moby authz zero length regression
V. Comments for CVE-2026-45692
No comments yet