This vulnerability allows an attacker to send a POST /load request to the local Caddy admin API, which replaces the server’s entire configuration. When the admin server has no origin policy enabled, the endpoint accepts cross‑origin requests from arbitrary web content. The attacker can supply a malicious JSON configuration that alters listener settings or HTTP behavior, effectively modifying Caddy without the user’s consent. The weakness is a broken request forgery protection (CWE‑352).

caddyserver caddy versions prior to 2.11.1. The vulnerability affects all builds that expose the local admin API on 127.0.0.1:2019 without origin enforcement.

CVSS 6.9 indicates a medium‑to‑high severity. The EPSS score is below 1 %, meaning the probability of exploitation is low but not zero. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to trick a victim into loading malicious web content that issues a POST /load request to localhost:2019. The assumption is that the victim’s browser will honour cross‑origin POSTs to the admin API, which has no origin check. Once the attack succeeds, the attacker can permanently modify the configuration of Caddy, potentially redirecting traffic, injecting headers, or disabling security features.