GO-2026-5730None▾ SunlitCaddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
github.com/caddyserver/caddy/v2 >= 2.11.0, < 2.11.3Upgrade to a patched release:
github.com/caddyserver/caddy/v2 2.11.3Connected by shared product, vendor, weakness, or advisory.
GHSA-wwhq-w58m-w29cMediumCaddy CVE-2026-30852 Fix Bypass
GO-2026-5408NoneCaddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
GHSA-gx7w-56w6-g48xMedium· 4.3Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
CVE-2026-45135High· 8.1caddy: github.com/caddyserver/caddy/v2: Caddy: Remote Code Execution via Unsafe Unicode Handling in FastCGI (CVE-2026-45135)
CVE-2026-45692Medium· 5.4Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
CVE-2026-52844High· 7.5Caddy: Windows `file_server` path authorization bypass via encoded backslash