GHSA-879p-475x-rqh2 Caddy is vulnerable to cross-origin config application via local admin API /load

• Go github.com/caddyserver/caddy/v2: < 2.11.1 → fixed in 2.11.1

commit: e0f8d9b2047af417d8faf354b675941f3dac9891 (as-of 2026-02-04) channel: GitHub security advisory (per SECURITY.md) summary The local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. this can change the admin listener settings and alter HTTP server behavior without user intent. Severity Medium Justification: • The attacker can apply an arbitrary caddy config (integrity impact) by driving a victim’s local admin API. • Exploitation requires a victim running caddy with the admin API enabled and visiting an attacker-controlled page (or otherwise issuing the request from an untrusted local client). Affected component • `caddyconfig/load.go: adminLoad.handleLoad` (`/load` admin endpoint) • Pinned callsite: https://github.com/caddyserver/caddy/blob/e0f8d9b2047af417d8faf354b675941f3dac9891/caddyconfig/load.go#L73 Reproduction Attachment: `poc.zip` (integration harness) with canonical and control runs. ```bash unzip -q -o poc.zip -d poc cd poc/poc-F-CADDY-ADMIN-LOAD-001 make test ``` Expected output (excerpt): ``` [CALLSITE_HIT]: adminLoad.handleLoad [PROOF_MARKER]: http_code=200 admin_moved=true response_pwned=true ``` Control output (excerpt): ``` [NC_MARKER]: http_code=403 load_blocked=true admin_moved=false response_pwned=false ``` Impact An attacker can replace the running caddy configuration via the local admin API. Depending on the deployed configuration/modules, this can: • Change admin listener settings (e.g., move the admin listener to a new address) • Change HTTP server behavior (e.g., alter routes/responses) Suggested remediation Ensure cross-origin web content cannot trigger `POST /load` on the local admin API by default, for example by: • Enabling origin enforcement by default for unsafe methods, and/or • Requiring an unguessable token for `/load` (and other state-changing admin endpoints). poc.zip PR_DESCRIPTION.md