CVE-2026-27586: Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed
Two swallowed errors in ClientAuthentication.provision() cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary.
References
- gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48
- github.com/advisories/GHSA-hffm-g8v7-wrv7
- github.com/caddyserver/caddy
- github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72
- github.com/caddyserver/caddy/releases/tag/v2.11.1
- github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7
- nvd.nist.gov/vuln/detail/CVE-2026-27586
Code Behaviors & Features
Detect and mitigate CVE-2026-27586 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →