CVE-2026-27586 — Improper Handling of Exceptional Conditions in Caddy
Severity
8.8HIGHNVD
EPSS
0.1%
top 69.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Latest updateFeb 26
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca…
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Packages3 packages
🔴Vulnerability Details
5CVEList▶
Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed↗2026-02-24
GHSA▶
Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed↗2026-02-24
OSV▶
Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed↗2026-02-24
📋Vendor Advisories
1Debian▶
CVE-2026-27586: caddy - Caddy is an extensible server platform that uses TLS by default. Prior to versio...↗2026