Vulnerability Report: GO-2026-4537
- CVE-2026-27589, GHSA-879p-475x-rqh2
- Affects: github.com/caddyserver/caddy/v2
- Published: Feb 26, 2026
Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2
For detailed information about this vulnerability, visit https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2.
Affected Packages
-
PathGo VersionsSymbols
-
before v2.11.1
50 affected symbols
- APIError.Error
- AdminHandlerFunc.ServeHTTP
- AppConfigDir
- AppDataDir
- BufferedLog
- ClearLastConfigIfDifferent
- Context.App
- Context.AppIfConfigured
- Context.IdentityCredentials
- Context.LoadModule
- Context.LoadModuleByID
- Context.Logger
- Context.Slogger
- Duration.UnmarshalJSON
- Event.CloudEvent
- GetModule
- GetModules
- HomeDir
- InstanceID
- Load
- Logging.Logger
- NetworkAddress.Listen
- NetworkAddress.ListenAll
- NetworkAddress.ListenQUIC
- NetworkAddress.String
- NewContext
- NewEvent
- PIDFile
- ParseDuration
- ParseNetworkAddress
- ParseNetworkAddressWithDefaults
- ParseStructTag
- ProvisionContext
- RegisterModule
- RemoveMetaFields
- Replacer.Get
- Replacer.GetString
- Replacer.ReplaceAll
- Replacer.ReplaceFunc
- Replacer.ReplaceKnown
- Replacer.ReplaceOrErr
- Run
- Stop
- StrictUnmarshalJSON
- ToString
- TrapSignals
- UsagePool.Delete
- UsagePool.LoadOrNew
- Validate
- Version
Aliases
References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2
- https://github.com/caddyserver/caddy/commit/65e0ddc22137bbbaa68c842ae0b98d0548504545
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1
- https://vuln.go.dev/ID/GO-2026-4537.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.