CVE-2026-27588
📋 TL;DR
Caddy servers with host lists exceeding 100 entries have a case-sensitivity vulnerability in the HTTP host matcher. Attackers can bypass host-based routing and access controls by manipulating the Host header casing. This affects Caddy servers using host-based routing with large host configurations.
💻 Affected Systems
- Caddy
📦 What is this software?
Caddy by Caddyserver
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of host-based access controls, allowing unauthorized access to restricted routes, potential data exposure, or privilege escalation.
Likely Case
Bypass of specific host-based routing rules, potentially accessing unintended backend services or bypassing security filters.
If Mitigated
Limited impact if additional authentication layers exist beyond host-based routing, or if host lists are small.
🎯 Exploit Status
Exploitation requires only HTTP header manipulation with no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.1
Vendor Advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8
Restart Required: Yes
Instructions:
1. Backup current Caddy configuration. 2. Update Caddy to version 2.11.1 or later using your package manager or download from GitHub releases. 3. Restart Caddy service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Reduce host list size
allReduce the number of host entries in your Caddy configuration to 100 or fewer to avoid the vulnerable code path.
Edit Caddyfile to consolidate or remove host entries
WAF/Proxy normalization
allDeploy a WAF or reverse proxy that normalizes Host headers to lowercase before they reach Caddy.
🧯 If You Can't Patch
- Implement additional authentication layers beyond host-based routing
- Deploy network-level controls to restrict access to vulnerable routes
🔍 How to Verify
Check if Vulnerable:
Check if Caddy version is below 2.11.1 AND configuration contains host-based routing with >100 entries.Check Version:
caddy versionVerify Fix Applied:
After updating to 2.11.1+, test with various Host header casings to ensure consistent routing behavior.📡 Detection & Monitoring
Log Indicators:
- Multiple access attempts with varying Host header casing
- Access to routes from unexpected hostnames
Network Indicators:
- HTTP requests with non-standard Host header casing
- Traffic to routes that should be blocked by host rules
SIEM Query:
source="caddy" AND (Host:*[A-Z]* OR http.host:*[A-Z]*)