Files or Directories Accessible to External Parties in Caddy - #VU163185
Published: November 9, 2026
Vulnerability identifier: #VU163185
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-552
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to download TLS private keys and local certificate authority keys from Caddy.
The vulnerability exists due to Caddy storing sensitive data in ./caddy when neither HOME nor XDG_DATA_HOME is set and exposing it through a file server rooted at the working directory. An unauthenticated remote attacker can request the exposed keys to impersonate the site or mint certificates trusted by clients that installed the local certificate authority.
Affected software
Caddy
Remediation
Install security update from vendor's website.
Caddy - update to 2.11.8