Terminal Spoofing Vulnerability in Ember Dashboard for Caddy Servers

CVE-2026-54162

What is CVE-2026-54162?

The Ember dashboard for Caddy servers presents a security issue where interactive TUI row formatters do not neutralize terminal escape sequences. This flaw allows unauthenticated remote clients to send crafted HTTP request targets containing these sequences. The resulting output may lead to monitoring dashboard spoofing and other manipulations, such as clipboard hijacking and window title spoofing. While not leading to general-purpose remote code execution, the vulnerability can still cause significant disinformation and requires operator attention to escalate further.

References