Code Injection in Caddy - CVE-2026-77281
Published: November 9, 2026
Vulnerability identifier: #VU163183
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77281
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to disclose Caddy process environment variables through rewritten request URLs.
The vulnerability exists due to repeated placeholder expansion in Caddy's rewrite handler when the configured rewrite URI incorporates request-controlled data and ends with a literal question mark. An unauthenticated remote attacker can inject environment-variable placeholders into a request header, causing their values to appear in the rewritten query string and become readable through a downstream handler that exposes it.
Affected software
Caddy
How to mitigate CVE-2026-77281
Install security update from vendor's website.
Caddy - update to 2.11.4