Vulnerability GO-2026-5408
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 months ago
July 24, 2026 at 06:35 PM UTC
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
v2.0.0-beta.13 - v2.11.2
v2.0.0-beta.13 - v2.11.2
Summary
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
Details
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
7 hours ago
Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy
v2.0.0-beta.13 - v2.11.3 GO-2026-6512
v2.0.0-beta.13 - v2.11.3 GO-2026-6512
Medium Risk
13 days ago
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
v2.0.0-beta.13 - v2.11.3 GHSA-j8px-rmrx-76h9
v2.0.0-beta.13 - v2.11.3 GHSA-j8px-rmrx-76h9
Unknown
2 months ago
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy
v2.0.0-beta.13 - v2.11.3 GO-2026-5346
v2.0.0-beta.13 - v2.11.3 GO-2026-5346
Unknown
2 months ago
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy
v2.7.0 - v2.11.2 GO-2026-5492
v2.7.0 - v2.11.2 GO-2026-5492
Unknown
2 months ago
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy
v2.0.0-beta.13 - v2.11.3 GO-2026-5595
v2.0.0-beta.13 - v2.11.3 GO-2026-5595
Impacted packages
Timeline
Published
2 months ago
July 24, 2026 at 06:35 PM UTC
Last Modified
2 months ago
July 24, 2026 at 07:00 PM UTC