Upstream Caddy vulnerabilities in the TLS-terminator image
Published 11 August 2026 · Last updated 25 August 2026 (rev 2)
Summary
The TLS terminator is a thin mirror of the upstream Caddy Alpine image. Eight advisories were published
against Caddy before 2.11.4: path and host matcher bypasses, a file_server
sanitisation bypass, an admin-API CORS weakness and /config traversal,
FastCGI request-splitting and identity-header injection, and a template XSS. EnforceGate uses Caddy only as
a minimal TLS terminator in front of the captive portal, with the admin API disabled and none of
file_server, FastCGI, forward_auth,
templates or host matchers configured.
Impact
In the default EnforceGate configuration seven of the eight issues do not apply, because the affected Caddy features are not enabled. The single reachable issue is CVE-2026-27587: Caddy's HTTP path matcher does not lowercase percent-escaped sequences before matching, so a crafted path can bypass path-based routing and any access control attached to that route.
In our terminator, path matching is used only for a small cleartext allowlist during the CA-bootstrap flow. The consequence of a bypass is therefore that a portal path could be served over plain HTTP when it should have been redirected to HTTPS. The upstream is the same captive portal either way, and no verdict or acknowledgement secret is designed to transit plain HTTP. There is no authentication bypass and no remote code execution in this configuration.
Why our rating differs from the upstream score
The upstream base scores rate the flaw in a generic Caddy deployment, where the path matcher may guard authenticated or otherwise sensitive routes; on that assumption a bypass reaches protected content, which is what produces the 9.1 Critical (CVSS v3.1) and 7.7 High (CVSS v4.0) figures. Base scores deliberately exclude the deploying environment.
EnforceGate does not use path matching that way: the only routes behind it are the public CA-bootstrap paths of the captive portal, which carry nothing confidential. Applying the environment to the score is what CVSS calls an environmental assessment, and on that basis we rate it Medium for the configuration we ship. If you have modified the terminator's Caddyfile to put path matchers in front of anything sensitive, the upstream rating is the one that applies to you: treat this as Critical and upgrade promptly.
Are you affected?
- Running 2026.52.0 (GD) or earlier with the standalone bundle, which includes the TLS terminator: yes, subject to the limited impact described above.
- Running 2026.55.2 (GD) or later: not affected, the fix is included.
Workarounds and resolution
No workaround is required. Upgrade to 2026.55.2 (GD) when convenient; this is not an emergency update. The terminator configuration is unchanged, only the Caddy base image moves from 2.10 to 2.11.4.
Revision history
- rev 2 (25 August 2026): corrected the fixed release to 2026.55.2 (GD). Rev 1 named 2026.53.0 (GD), which was never published as a customer bundle, so readers could not obtain it and anyone on a later internal build might have believed themselves patched. Nothing else changed: the affected versions, severity and analysis are unaltered.
- rev 1 (11 August 2026): initial publication.