CVE-2026-27587 is a critical flaw (CVSS 9.1) in Caddy. The path matcher is meant to be case insensitive but is not when the pattern contains percent escapes, so changing the casing of a request path can skip the route and its access controls. Upgrade to Caddy 2.11.1.
What's affected
Caddy before 2.11.1. The bug appears only for path matchers whose pattern contains percent escape sequences such as %2F. Plain patterns follow the normal case insensitive path.
GitHub advisories for these Caddy issues list v2.11.0 as the patched version, but the release notes say the first 2.11 release was published as v2.11.1, with no code changes from v2.11.0 other than a CI job. Plan on v2.11.1 or later.
The KEV flag is false.
How to check if you're exposed
Check the version, then search your configuration for path matchers that contain a percent sign.
caddy version
grep -rn "path" /etc/caddy/ | grep "%"
For Caddyfile or JSON configs, list every route that uses a path matcher with an escape and note whether it blocks, authenticates or restricts access. Those are the routes where a mismatch matters.
What to do now
- Upgrade to Caddy 2.11.1 or later.
- Review routes that use percent escaped path patterns and that carry access controls.
- Do not make a single path matcher the only barrier in front of an admin area. Enforce authentication in the application or with a catch all deny that does not depend on exact casing.
- Check logs for requests to protected paths in unusual letter case.
Why it matters
The weakness is an inconsistent case handling issue, CWE-178. The matcher lowercases the configured pattern and the normal request path, but for the percent escape case it compares against the raw escaped path, which is not lowercased. Two request paths that mean the same thing then get different routing results.
Routing is where many teams hang access rules, so an inconsistency here becomes an authorization bypass. A request to the escaped path in the intended case is denied, and the same request with different casing falls through to another handler. The fix makes the comparison case insensitive again.
Quick check
Does the path matcher bug affect every Caddy route?
No. The advisory ties it to patterns that contain percent escape sequences.
Sources
Last reviewed: 19 October 2026.
