mTLS Authentication Vulnerability in Caddy by Caddy Server
CVE-2026-27586
What is CVE-2026-27586?
The Caddy server, a platform designed for ease of use and extensibility, has a vulnerability that impacts its mTLS client certificate authentication process. Prior to version 2.11.1, errors in the ClientAuthentication.provision() function allowed the server to fail open when authentication files were missing or malformed. This flaw means that the server would accept any client certificate signed by a system-trusted CA, effectively bypassing the configured private CA trust boundary. As a result, deployments relying on the trusted_ca_cert_file or trusted_ca_certs_pem_files options could be rendered insecure if the necessary CA files were made unavailable due to issues like path typos or permission changes, without any warning from the server. The vulnerability was addressed in version 2.11.1.
Affected Version(s)
caddy < 2.11.1