CVE-2026-27586

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.

• CWE-755

• https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48Exploit
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1Release Notes
• https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7Exploit, Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27580Rejected reason: Further research determined the situation d…
• CVE-2026-27581Rejected reason: Further research determined the situation d…
• CVE-2026-27582Rejected reason: Further research determined the situation d…
• CVE-2026-27583Rejected reason: Further research determined the situation d…
• CVE-2026-27584Actual is a local-first personal finance tool. Prior to vers…7.5
• CVE-2026-27585Caddy is an extensible server platform that uses TLS by defa…6.5
• CVE-2026-27587Caddy is an extensible server platform that uses TLS by defa…9.1
• CVE-2026-27588Caddy is an extensible server platform that uses TLS by defa…9.1
• CVE-2026-27589Caddy is an extensible server platform that uses TLS by defa…6.5
• CVE-2026-2759Incorrect boundary conditions in the Graphics: ImageLib comp…9.8
• CVE-2026-27590Caddy is an extensible server platform that uses TLS by defa…9.8
• CVE-2026-27591Winter is a free, open-source content management system (CMS…9.9