Caddy

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Caddy qualifies at Tier 2 through its OSS-Fuzz integration, so the ceiling is $5,000 and not the $15,000 Tier 1 headline. A maintainer has to accept the change, patches must be one to twelve months old, one-liner fixes for non-exploitable crashes are not rewarded, and sanctions and territory exclusions apply. CVE history 13 Last 12 months 20 Lifetime Access control 35 % Parsing/validation 30 % Auth bypass 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Caddy is the HTTPS-by-default web server of the self-hosting, homelab and small SaaS world: the reverse proxy inside a large share of Docker Compose stacks, the server behind Coolify and CapRover and much of the PaaS-in-a-box category, and the origin of certmagic , whose certificate automation is embedded far beyond Caddy itself. It went from a quiet codebase to the second most CVE-active project in this niche in a single year, 13 of its 20 lifetime CVEs landing in the last twelve months, and those landed directly on authentication boundaries in real deployments: CVE-2026-52845 was a forward_auth copy_headers flaw. Caddy says in writing that it has no budget for bounties, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Caddy's policy takes reports through GitHub private vulnerability reporting on caddyserver/caddy and asks for a security bug in the source code of that repository. Misconfigurations, IP spoofing, BGP hijacks and missing or misconfigured HTTP headers are named out of scope, and everything below sits inside what remains The whole request matcher set, including path and host , which decides which handler a request lands on and therefore which access rule applies to it reverse_proxy in full, across every transport it ships, including the FastCGI transport used to reach php-fpm forward_auth and its copy_headers handling, the seam where an external authenticator's decision is trusted The local admin API on localhost:2019 , the boundary that is supposed to keep it local, and the config load and reload path behind it Automatic HTTPS end to end: ACME issuance, on-demand TLS, the certificate cache and the certmagic code underneath them Every handler module shipped in the standard distribution, including file_server and the templates handler with its template functions such as stripHTML The Caddyfile adapter and the JSON configuration structure it produces Out of scope Third-party Caddy modules built with xcaddy , which are not source code from the Caddy repository Misconfigurations, ruled out explicitly by the project's own policy IP spoofing, BGP hijacks, and missing or misconfigured HTTP headers, named out of scope verbatim Reports that require an already-compromised system or third-party software One-liner fixes for non-exploitable crashes, excluded by name in the Patch Rewards rules The Tier 1 ceiling, which Caddy cannot reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project Most-valued findings Matcher confusion in path or host that routes a request past an access rule the operator wrote, the highest-value class here because access control is 35 percent of the record and the whole February 2026 run of five CVEs was this shape forward_auth handling that lets a client forge or retain a header the authenticator was supposed to control, turning the external auth decision into an attacker-controlled one. CVE-2026-52845 is that shape FastCGI path handling that lets a crafted request reach a script or file the reverse proxy never intended to expose, the shape of CVE-2026-27590 and CVE-2026-45135 Any path from an ordinary request to the admin API on port 2019, since that interface reconfigures the whole server at runtime Certificate-issuance or on-demand TLS defects that get a certificate issued for, or served on, a name the operator does not control. Caddy's automatic HTTPS is the feature everything else here is built on Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately through GitHub private vulnerability reporting on caddyserver/caddy, with the Caddyfile or JSON config and the request that triggers it The report has to demonstrate a security bug in the source code from that repository. Modules built in with xcaddy are somebody else's code Misconfigurations are explicitly out of scope, as are IP spoofing, BGP hijacks and missing or misconfigured HTTP headers Findings that require an already-compromised system or third-party software are not eligible If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway capped at $5,000, since Caddy qualifies at Tier 2 through OSS-Fuzz rather than as a named Tier 1 project Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated through GitHub private vulnerability reporting, and Caddy publishes the outcome as a GitHub Security Advisory with a patched release; its triage is fast and public, and the 2026 advisory cadence shows an active process with, by the project's own statement, no money attached. Patch Rewards adds no embargo term of its own, so hold the detail until the advisory is published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability