PT-2026-21768 · Caddy · Caddy

Moscowchill · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27586

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1

Description Caddy, an extensible server platform that uses TLS by default, has an issue where mTLS client certificate authentication can silently fail open under certain conditions. Specifically, if a CA certificate file is missing, unreadable, or malformed, the server starts without error but accepts any client certificate signed by any system-trusted CA, bypassing the intended private CA trust boundary. This occurs because errors in the ClientAuthentication.provision() function are swallowed, preventing the server from recognizing the misconfiguration. The issue affects deployments using trusted ca cert file or trusted ca certs pem files for mTLS. The root cause lies in incorrect error handling within the provision() method in modules/caddytls/connpolicy.go, where return nil should be return err on lines 787 and 800. A proof-of-concept demonstrates that a client can successfully connect with any certificate, even a self-signed one, when the CA file is nonexistent.

Recommendations Versions prior to 2.11.1 should be updated to version 2.11.1 or later to resolve this issue.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2026-27586

GHSA-HFFM-G8V7-WRV7

GO-2026-4539

SUSE-SU-2026:0757-1

Affected Products

Caddy

References · 126

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27586.json · Exploit
• 🔥 https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48 · Exploit
• https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27586 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hffm-g8v7-wrv7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27586 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27586 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27586 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27586 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27586 · Security Note
• https://ubuntu.com/security/CVE-2026-27586 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4539 · Vendor Advisory
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1 · Note