StackRadar

CVE-2026-92700

Medium

Advisory

Published 18 Sept 2026In the index since 24 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
30
of 18,143 indexed, latest versions
Container images
26
deployed by those charts
Fix available
1 of 2
affected packages

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Carried by container images the latest versions of 30 of 18,143 indexed charts deploy, on 26 images.

Affected packageAffected versionsFixed inImages
github.com/caddyserver/caddy/v2golangv2.2.0, v2.4.0, v2.4.2, v2.4.5+12 more2.11.425
caddydeb2.11.7-1no fix listed1
OSV records
DEBIAN-CVE-2026-92700GHSA-j8px-rmrx-76h9GO-2026-6512
Also known as
CVE-2026-77281, CVE-2026-92284

Charts affected

30 by stars
ChartLatestAffected imagesRadar Score
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

19,362
caddy-ingress-controllercaddy-ingress1.3.01 of 1See more

caddy-ingress-controller caddy-ingress 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

2,629
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
github.com/caddyserver/caddy/v2@v2.7.6
2.11.4

Open the chart page →

17,543
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
kubevious/ui:1.2.16233e84bdd59
github.com/caddyserver/caddy/v2@v2.6.1
2.11.4

Open the chart page →

17,997
wordpress-hardenedriotkit-org2.0.01 of 2See more

wordpress-hardened riotkit-org 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4

Open the chart page →

8,570
maintenancecodewithemadVerified publisher0.1.61 of 1See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.9-alpineb4e3952384eb
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4

Open the chart page →

2,098
fluorite-chartfluorite-helmOfficialVerified publisher0.1.01 of 1See more

fluorite-chart fluorite-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
ghcr.io/afcms/fluorite:master613761b9d712
caddy@2.11.7-1
no fix listed

Open the chart page →

36
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/caddyserver/caddy/v2@v2.5.0
2.11.4

Open the chart page →

3,607
kubebrowsekubebrowse1.7.01 of 5See more

kubebrowse kubebrowse 1.7.0

1 of the 5 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

4,074
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

10,709
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4

Open the chart page →

12,327
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4

Open the chart page →

2,199
mercurecloudnativeapp1.0.21 of 1See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
dunglas/mercure:v0916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

1,498
parrot-mirroremmas-chartsVerified publisher1.0.01 of 1See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4

Open the chart page →

3,028
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4

Open the chart page →

23,205
fluxer-helmfluxer-helm0.3.01 of 18See more

fluxer-helm fluxer-helm 0.3.0

1 of the 18 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
ghcr.io/fluxerapp/fluxer-static:2026.812.125337cfe98ae544df
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

34,243
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.2.0-alpine7367adca165f
github.com/caddyserver/caddy/v2@v2.2.0
2.11.4

Open the chart page →

10,719
vikunjageek-cookbookVerified publisher6.2.01 of 4See more

vikunja geek-cookbook 6.2.0

1 of the 4 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/caddyserver/caddy/v2@v2.4.2
2.11.4

Open the chart page →

9,993
castopodhelmforgeVerified publisher1.2.111 of 3See more

castopod helmforge 1.2.11

1 of the 3 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

11,109
discount-bandithelmforgeVerified publisher2.0.91 of 3See more

discount-bandit helmforge 2.0.9

1 of the 3 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

36,965
openreplayhelmforgeVerified publisher1.0.01 of 24See more

openreplay helmforge 1.0.0

1 of the 24 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.10.2-alpine4c6e91c6ed0e
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4

Open the chart page →

14,913
pimcorehelmforgeVerified publisher2.0.51 of 6See more

pimcore helmforge 2.0.5

1 of the 6 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4

Open the chart page →

3,554
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4

Open the chart page →

7,336
op-scim-bridgelifen1.0.31 of 2See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4

Open the chart page →

4,345
op-scim-bridgelifen-chartsVerified publisher1.0.31 of 2See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4

Open the chart page →

4,345
solgateloafoe0.0.121 of 1See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4

Open the chart page →

2,892
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
novosga/novosga:latest9957d44343db
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4

Open the chart page →

5,228
gitlab-proxyopslevelVerified publisher0.0.81 of 1See more

gitlab-proxy opslevel 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.660fb54d36b4b
github.com/caddyserver/caddy/v2@v2.6.4
2.11.4

Open the chart page →

2,762
caddysagikazarmarkVerified publisher0.0.141 of 1See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
library/caddy:2.4.5874405536b3e
github.com/caddyserver/caddy/v2@v2.4.5
2.11.4

Open the chart page →

4,177
tfy-cloudflaredtruefoundryVerified publisher0.6.01 of 2See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-92700.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/caddyserver/caddy/v2@v2.6.3
2.11.4

Open the chart page →

2,907

Container images carrying it

26 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
caddy/ingress:v0.2.118d1366fc0e9
github.com/caddyserver/caddy/v2@v2.7.5
github.com/caddyserver/caddy/v2@v2.7.5
2.11.4
2.11.4
3
1password/scim:v2.3.129d0c6cb67eb
github.com/caddyserver/caddy/v2@v2.4.0
github.com/caddyserver/caddy/v2@v2.4.0
2.11.4
2.11.4
2
dunglas/mercure:v0:v0.24.2916834e49961
github.com/caddyserver/caddy/v2@v2.11.3
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4
2.11.4
2
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
github.com/caddyserver/caddy/v2@v2.11.3
github.com/caddyserver/caddy/v2@v2.11.3
2.11.4
2.11.4
1
baserow/baserow:1.30.1df0c42eb67e8
github.com/caddyserver/caddy/v2@v2.7.6
github.com/caddyserver/caddy/v2@v2.7.6
2.11.4
2.11.4
1
castopod/castopod:1.15.54e4f0440520f
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/caddyserver/caddy/v2@v2.5.0
github.com/caddyserver/caddy/v2@v2.5.0
2.11.4
2.11.4
1
kubevious/ui:1.2.16233e84bdd59
github.com/caddyserver/caddy/v2@v2.6.1
github.com/caddyserver/caddy/v2@v2.6.1
2.11.4
2.11.4
1
library/caddy:2.10.2-alpine4c6e91c6ed0e
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
library/caddy:2.660fb54d36b4b
github.com/caddyserver/caddy/v2@v2.6.4
github.com/caddyserver/caddy/v2@v2.6.4
2.11.4
2.11.4
1
library/caddy:2.2.0-alpine7367adca165f
github.com/caddyserver/caddy/v2@v2.2.0
github.com/caddyserver/caddy/v2@v2.2.0
2.11.4
2.11.4
1
library/caddy:2.11.2-alpine834468128c76
github.com/caddyserver/caddy/v2@v2.11.2
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4
2.11.4
1
library/caddy:2.4.5874405536b3e
github.com/caddyserver/caddy/v2@v2.4.5
github.com/caddyserver/caddy/v2@v2.4.5
2.11.4
2.11.4
1
library/caddy:2.9-alpineb4e3952384eb
github.com/caddyserver/caddy/v2@v2.9.1
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4
2.11.4
1
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/caddyserver/caddy/v2@v2.4.2
github.com/caddyserver/caddy/v2@v2.4.2
2.11.4
2.11.4
1
novosga/novosga:latest9957d44343db
github.com/caddyserver/caddy/v2@v2.11.2
github.com/caddyserver/caddy/v2@v2.11.2
2.11.4
2.11.4
1
ghcr.io/afcms/fluorite:master613761b9d712
caddy@2.11.7-1
no fix listed
1
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
ghcr.io/fluxerapp/fluxer-static:2026.812.125337cfe98ae544df
github.com/caddyserver/caddy/v2@v2.10.2
github.com/caddyserver/caddy/v2@v2.10.2
2.11.4
2.11.4
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/caddyserver/caddy/v2@v2.9.1
github.com/caddyserver/caddy/v2@v2.9.1
2.11.4
2.11.4
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/caddyserver/caddy/v2@v2.7.4
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4
2.11.4
1
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
github.com/caddyserver/caddy/v2@v2.5.1
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4
2.11.4
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/caddyserver/caddy/v2@v2.6.3
github.com/caddyserver/caddy/v2@v2.6.3
2.11.4
2.11.4
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/caddyserver/caddy/v2@v2.5.1
github.com/caddyserver/caddy/v2@v2.5.1
2.11.4
2.11.4
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/caddyserver/caddy/v2@v2.7.4
github.com/caddyserver/caddy/v2@v2.7.4
2.11.4
2.11.4
1

syft 1.42.1 · advisories as of 17 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.