onyx --cves cve-2026-27589

CVE-2026-27589

score: 0.1
cvss: 6.5
epss: 0.2%
published: 2026-02-24
kev added: —
first seen: 2026-10-21

Caddy < 2.11.1 contains a cross-site request forgery caused by missing origin enforcement on the local admin API's POST /load endpoint, letting attackers change server configuration via cross-origin requests, exploit requires origin enforcement disabled.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2026-02-24 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC https://github.com/user-attachments/files/25079818/poc.zip

Exploit availability

https://github.com/user-attachments/files/25079818/poc.zip

Weaknesses

CWE-352

References 4

https://github.com/caddyserver/caddy/releases/tag/v2.11.1
https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2
https://github.com/user-attachments/files/25079818/poc.zip
https://github.com/user-attachments/files/25079820/PR_DESCRIPTION.md