ZDF
Sign inSign up

Vulnerabilities

Security research · GHSA-gx7w-56w6-g48x

Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

Published May 13, 2026 · catalog updated May 13, 2026 · Remote Admin Authorization Bypass

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-gx7w-56w6-g48x. A missing EPSS score is not a low risk. Compare Remote Admin Authorization Bypass with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Remote Admin Authorization Bypass).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium4.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Version ranges on file
Affected products
go github.com/caddyserver/caddy/v2

## AI Disclosure I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report. I manually validated the finding by reproducing it locally, confirming the vulnerable code path, and verifying the HTTP behavior with . ## Summary Caddy's remote admin access control performs path authorization using prefix matching: - [ ](/caddy/admin.go#L719): This allows a client certificate authorized only for to access sibling PKI resources whose paths merely share the same prefix, such as . This is an authorization bug in Caddy's source code, not a misconfiguration issue. The configured policy is more restrictive than the behavior that Caddy actually enforces. ## Affected Component Remote admin access control for PKI admin endpoints. Relevant code: - [ ](/caddy/admin.go#L687) - [ ](/caddy/admin.go#L719) - [ ](/caddy/modules/caddypki/adminapi.go#L68) - [ ](/caddy/modules/caddypki/adminapi.go#L164) ## Root Cause In , allowed paths are checked like this: This does not enforce a path-segment boundary. So if the allowed path is: /pki/ca/prod then all of the following are treated as authorized: - /pki/ca/prod-backup - /pki/ca/prod1 - /pki/ca/prodanything For PKI admin endpoints, the CA ID is taken directly from the request path: - modules/caddypki/adminapi.go:164 So /pki/ca/prod-backup is interpreted as CA ID prod-backup, even though only /pki/ca/prod was intended to be allowed. ## Security Impact A remote admin client certificate restricted to one PKI CA path can access other CA resources with the same prefix. This breaks least-privilege remote admin policies and results in authenticated authorization bypass. ## Minimal Configuration File: repro.json ## Reproduction Steps From Scratch ### 1. Generate a client certificate ### 2. Convert the client certificate to base64 DER CLIENT_CERT_B64="$(openssl x509 -in client.crt -outform der | base64 | tr -d '\n')" ### 3. Put that value into repro.json Replace: with the value of CLIENT_CERT_B64. #

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • go github.com/caddyserver/caddy/v2< v2.11.3

How to fix GHSA-gx7w-56w6-g48x

  • Upgrade

    GHSA-gx7w-56w6-g48x lists a fix boundary at v2.11.3. Compare the installed build with that boundary before you change production.

  • Version check

    Seen in < v2.11.3

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-gx7w-56w6-g48x. A missing EPSS score is not a low risk. Compare Remote Admin Authorization Bypass with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with < v2.11.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Caddy security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2026 · Maintainer security tabs

    Detected

    ## AI Disclosure I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report. I manually validated the finding by reproducing it locally, confirming the vulnerable code path, and verifying the HTTP behavior with . ## Summary Caddy's remote admin access control performs path authorization using prefix matching: - [ ](/caddy/admin.go#L719): This a

Sources

  • Maintainer security tabsVendor advisoryGHSA-gx7w-56w6-g48x

    ## AI Disclosure I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report. I manually validated the finding by reproducing it locally, confirming the vulnerable code path, and verifying the HTTP behavior with . ## Summary Caddy's remote admin access control performs path authorization using prefix matching: - [ ](/caddy/admin.go#L719): This a

    github.com

Freshness

Last verified in this catalog May 13, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 1, 2026