Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the     authorization layer and the /config traversal layer do not agree on what object the path refers to. In     this case, a path authorized for one config object is accepted, but then resolves to a different config     object during traversal. This happens because the authorization layer uses string prefix matching and the     /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed     in 2.11.3. (CVE-2026-45692)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI
    transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses
    golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two
    distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php
    (or other configured split_path extension) file as a script. In any deployment where the attacker can
    place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to
    remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in
    2.11.3. (CVE-2026-45135)

  - Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the
    authorization layer and the /config traversal layer do not agree on what object the path refers to. In
    this case, a path authorized for one config object is accepted, but then resolves to a different config
    object during traversal. This happens because the authorization layer uses string prefix matching and the
    /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed
    in 2.11.3. (CVE-2026-45692)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the
    authorization layer and the /config traversal layer do not agree on what object the path refers to. In
    this case, a path authorized for one config object is accepted, but then resolves to a different config
    object during traversal. This happens because the authorization layer uses string prefix matching and the
    /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed
    in 2.11.3. (CVE-2026-45692)

ID	Name	Product	Family	Severity
322473	Linux Distros Unpatched Vulnerability : CVE-2026-45692	Nessus	Misc.	low
443105	Alpine: multiple caddy packages: security update to 2.11.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
443105	Alpine: multiple caddy packages: security update to 2.11.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
442157	SCA: security update for github.com/caddyserver/caddy/v2 (GHSA-x5w9-xh9r-mvfc)	Tenable Cloud Security	SCA Checks	low
442157	SCA: security update for github.com/caddyserver/caddy/v2 (GHSA-x5w9-xh9r-mvfc)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-45692

low

Tenable Plugins

low

low

low

low

low