Improper Access Control

🗓️ 30 Apr 2026 03:15:00Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 9 Views

Caddy has improper access control due to case-insensitive host header matching, enabling bypass.

Reporter	Title	Published	Views	Family All 117
ATTACKERKB	CVE-2026-27588	24 Feb 202616:28	–	attackerkb
AlpineLinux	CVE-2026-27588	24 Feb 202616:28	–	alpinelinux
Circl	CVE-2026-27588	23 Feb 202604:23	–	circl
CNNVD	Caddy 安全漏洞	24 Feb 202600:00	–	cnnvd
CVE	CVE-2026-27588	24 Feb 202616:28	–	cve
Cvelist	CVE-2026-27588 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass	24 Feb 202616:28	–	cvelist
Debian CVE	CVE-2026-27588	24 Feb 202616:28	–	debiancve
Github Security Blog	Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass	24 Feb 202620:34	–	github
NVD	CVE-2026-27588	24 Feb 202617:29	–	nvd
OSV	CVE-2026-27588 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass	24 Feb 202616:28	–	osv

Vulners

Node

caddy_project caddyMatch2.9.1-r2go

AND

caddy_project caddyMatch2.7.4-r1go

AND

caddy_project caddyMatch2.6.3-r0go

AND

caddy_project caddyMatch2.5.1-r0go

AND

caddy_project caddyMatch2.9.1-r0go

AND

caddy_project caddyMatch2.6.1-r0go

AND

caddy_project caddyMatch2.6.4-r1go

AND

caddy_project caddyMatch2.4.1-r0go

AND

caddy_project caddyMatch2.7.6-r5go

AND

caddy_project caddyMatch2.5.0-r0go

AND

caddy_project caddyMatch2.7.6-r0go

AND

caddy_project caddyMatch2.4.6-r3go

AND

caddy_project caddyMatch1.0.4-r2go

AND

caddy_project caddyMatch2.6.2-r2go

AND

caddy_project caddyMatch2.4.2-r0go

AND

caddy_project caddyMatch2.9.1-r3go

AND

caddy_project caddyMatch2.7.6-r7go

AND

caddy_project caddyMatch1.0.4-r3go

AND

caddy_project caddyMatch2.10.0-r3go

AND

caddy_project caddyMatch2.5.1-r1go

AND

caddy_project caddyMatch2.4.5-r1go

AND

caddy_project caddyMatch2.8.4-r3go

AND

caddy_project caddyMatch2.10.0-r2go

AND

caddy_project caddyMatch2.10.2-r0go

AND

caddy_project caddyMatch2.6.1-r1go

AND

caddy_project caddyMatch2.8.4-r1go

AND

caddy_project caddyMatch2.4.6-r2go

AND

caddy_project caddyMatch2.7.4-r0go

AND

caddy_project caddyMatch2.8.4-r2go

AND

caddy_project caddyMatch2.7.5-r0go

AND

caddy_project caddyMatch2.4.0-r0go

AND

caddy_project caddyMatch2.6.2-r3go

AND

caddy_project caddyMatch2.6.4-r6go

AND

caddy_project caddyMatch2.10.0-r1go

AND

caddy_project caddyMatch2.10.0-r0go

AND

caddy_project caddyMatch2.8.4-r0go

AND

caddy_project caddyMatch2.10.2-r4go

AND

caddy_project caddyMatch2.7.6-r6go

AND

caddy_project caddyMatch2.5.2-r3go

AND

caddy_project caddyMatch2.5.2-r1go

AND

caddy_project caddyMatch2.6.0-r0go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.7.6-r3go

AND

caddy_project caddyMatch2.6.2-r1go

AND

caddy_project caddyMatch2.4.5-r0go

AND

caddy_project caddyMatch2.5.2-r0go

AND

caddy_project caddyMatch2.7.6-r2go

AND

caddy_project caddyMatch2.4.6-r0go

AND

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.7.6-r4go

AND

caddy_project caddyMatch2.5.2-r2go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.3.0-r0go

AND

caddy_project caddyMatch2.6.4-r5go

AND

caddy_project caddyMatch2.6.4-r4go

AND

caddy_project caddyMatch2.6.2-r0go

AND

caddy_project caddyMatch2.9.1-r1go

AND

caddy_project caddyMatch2.6.4-r3go

AND

caddy_project caddyMatch2.4.3-r0go

AND

caddy_project caddyMatch2.6.4-r2go

AND

caddy_project caddyMatch2.7.3-r0go

AND

caddy_project caddyMatch2.7.6-r1go

AND

caddy_project caddyMatch2.4.1-r1go

AND

alpinelinux alpine_linuxMatchedge

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.10.2-r5go

AND

caddy_project caddyMatch2.10.2-r4go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.10.2-r3go

AND

alpinelinux alpine_linuxMatch3.23

caddyserver github.com/caddyserver/caddyRangev2.3.0-rc.1–2.3.0-rc.1go

Source	Link
github	www.github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8
github	www.github.com/caddyserver/caddy/commit/eec32a0bb5a11651c6a7b04ce82dc50610f2b27e
secdb	www.secdb.alpinelinux.org/v3.23/community.yaml

15 May 2026 08:07Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

CVSS 48.7

EPSS0.0037

SSVC