Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Caddy bug bounty programs

caddyserver.com Updated

Caddy runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Caddy runs.

  • Caddy

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://caddyserver.com

    Web

  • Automatic HTTPS end to end: ACME issuance, on-demand TLS, the certificate cache and the certmagic code underneath them

    Products and areas

  • Caddy's policy takes reports through GitHub private vulnerability reporting on caddyserver/caddy and asks for a security bug in the source code of that repository. Misconfigurations, IP spoofing, BGP hijacks and missing or misconfigured HTTP headers are named out of scope, and everything below sits inside what remains

    Products and areas

  • Every handler module shipped in the standard distribution, including file_server and the templates handler with its template functions such as stripHTML

    Products and areas

  • forward_auth and its copy_headers handling, the seam where an external authenticator's decision is trusted

    Products and areas

  • reverse_proxy in full, across every transport it ships, including the FastCGI transport used to reach php-fpm

    Products and areas

  • The Caddyfile adapter and the JSON configuration structure it produces

    Products and areas

  • The local admin API on localhost:2019, the boundary that is supposed to keep it local, and the config load and reload path behind it

    Products and areas

  • The whole request matcher set, including path and host, which decides which handler a request lands on and therefore which access rule applies to it

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • IP spoofing, BGP hijacks, and missing or misconfigured HTTP headers, named out of scope verbatim

  • Misconfigurations, ruled out explicitly by the project's own policy

  • One-liner fixes for non-exploitable crashes, excluded by name in the Patch Rewards rules

  • Reports that require an already-compromised system or third-party software

  • The Tier 1 ceiling, which Caddy cannot reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project

  • Third-party Caddy modules built with xcaddy, which are not source code from the Caddy repository

Recent changes

Reward and scope changes across every Caddy program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Caddy products, from the NVD.

Search NVD
  • CVE-2026-52844 High

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

  • CVE-2026-52845 High

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the

  • CVE-2026-52846 Medium

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases w

  • CVE-2026-45692 Medium

    Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching a

  • CVE-2026-45135 High

    Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or ot

  • CVE-2026-30851 High

    Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

  • CVE-2026-30852 Medium

    Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug).

  • CVE-2026-27585 Medium

    Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

About this page

This page gathers every public program listed under caddyserver.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.