CVE-2026-27586

Name
CVE-2026-27586
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48
security-advisories@github.com https://github.com/caddyserver/caddy/releases/tag/v2.11.1
security-advisories@github.com https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* caddy >= None < 2.11.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
caddy edge-community 2.11.1-r0 Michał Polański <michal@polanski.me> fixed
caddy edge-community 2.10.2-r4 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.2-r3 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.2-r2 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.2-r1 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.2-r0 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.0-r3 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.0-r2 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.0-r1 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.10.0-r0 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.9.1-r4 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.9.1-r3 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.9.1-r2 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.9.1-r1 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.9.1-r0 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.8.4-r3 Michał Polański <michal@polanski.me> possibly vulnerable
caddy edge-community 2.8.4-r2 Michał Polański <michal@polanski.me> possibly vulnerable
caddy 3.23-community 2.10.2-r5 Michał Polański <michal@polanski.me> possibly vulnerable
caddy 3.23-community 2.10.2-r4 Michał Polański <michal@polanski.me> possibly vulnerable
caddy 3.23-community 2.10.2-r3 Michał Polański <michal@polanski.me> possibly vulnerable
caddy 3.23-community 2.10.2-r2 Michał Polański <michal@polanski.me> possibly vulnerable