Go/github.com/caddyserver/caddy/v2 CVE-2026-45692: low 3.8, EPSS 0.24%

Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.3 or later.

go get github.com/caddyserver/caddy/v2@v2.11.3

Affected

Fixed versions

Sources

• osv: GO-2026-5743
• nvd: CVE-2026-45692
• https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc

CVE-2026-45692 · published 2026-07-07T16:52:19Z · modified 2026-07-07T20:30:14.960575546Z · JSON