Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-24 | 2 | Disclosure2 |
| 2026-02-25 | 1 | Patch1 |
CVE-2026-27586 Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client… https://www.cve.org/CVERecord?id=CVE-2026-27586
Post summary
CVE-2026-27586 involves swallowed errors in Caddy's mTLS client authentication, fixed in version 2.11.1.
CVE-2026-27586: Caddy Shack: How a Missing File Turns mTLS into an Open Door A critical logic error in Caddy Server's TLS module causes mutual TLS (mTLS) authentication to fail open if the configured Certificate Authority (CA) file is missing or unrea... https://cvereports.com/reports/CVE-2026-27586
Post summary
The report describes a critical logic flaw in Caddy Server’s TLS module that causes mTLS authentication to fail open when the CA file is missing, but it does not provide a PoC, exploit, or patch information.
CVE-2026-27586 Caddy mTLS Client Authentication Bypass in Versions Prior to 2.11.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27586
Post summary
Caddy mTLS client authentication bypass disclosed for versions before 2.11.1; no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | caddyserver | caddy | - | - | - |