Security patch:

[MODERATE] GHSA-gx7w-56w6-g48x: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

GitHub Security Advisory·Security·SecurityFix·5/19/2026

## AI Disclosure I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report. I manually validated the finding by reproducing it locally, confirming the vulnerable code path, and verifying the HTTP behavior with `curl -v`. ## Summary Ca

Why it matters → A security vulnerability was patched. Upgrade affected versions to mitigate risk.

Who should care → Anyone running affected versions in production.

github.com/caddyserver/caddy/v2

View original source ↗

Source payload preview

{
  "ghsaId": "GHSA-gx7w-56w6-g48x",
  "summary": "Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching",
  "severity": "MODERATE",
  "updatedAt": "2026-05-19T19:36:14Z",
  "references": [
    {
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-gx7w-56w6-g48x"
    },
    {
      "url": "https://github.com/advisories/GHSA-gx7w-56w6-g48x"
    }
  ],
  "description": "## AI Disclosure\n\n  I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report.\n  I manually validated the finding by reproducing it locally, confirming the vulnerable code path, and verifying the HTTP behavior with `curl -v`.\n\n  ## Summary\n\n  Caddy's remote admin access control performs path authorization u
…