https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T09:39:36.360349+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273774 EUVD-2026-273774 2026-10-04T09:39:36.434625+00:00 EUVD-2026-273774 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27589 fkie_cve-2026-27589 2026-10-04T09:39:36.434672+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-879p-475x-rqh2 GHSA-879p-475x-rqh2 — Caddy is vulnerable to cross-origin config application via local admin API /load 2026-10-04T09:39:36.434757+00:00

Affected: Go: github.com/caddyserver/caddy/v2

commit: e0f8d9b2047af417d8faf354b675941f3dac9891 (as-of 2026-02-04) channel: GitHub security advisory (per SECURITY.md)

## summary

The local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration.

When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. this can change the admin listener settings and alter HTTP server behavior without user intent.

## Severity

Medium

Justification: - The attacker can apply an arbitrary caddy config (integrity impact) by driving a victim’s local admin API. - Exploitation requires a victim running caddy with the admin API enabled and visiting an attacker-controlled page (or otherwise issuing the request from an untrusted local client).

## Affected component

- `caddyconfig/load.go: adminLoad.handleLoad` (`/load` admin endpoint) - Pinned callsite: https://github.com/caddyserver/caddy/blob/e0f8d9b2047af417d8faf354b675941f3dac9891/caddyconfig/load.go#L73

## Reproduction

Attachment: `poc.zip` (integration harness) with canonical and control runs.

```bash unzip -q -o poc.zip -d poc cd poc/poc-F-CADDY-ADMIN-LOAD-001 make test ```

Expected output (excerpt):

``` [CALLSITE_HIT]: adminLoad.handleLoad [PROOF_MARKER]: http_code=200 admin_moved=true response_pwned=true ```

Control ou…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27589 UBUNTU-CVE-2026-27589 2026-10-04T09:39:36.434826+00:00

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.