CVE-2026-27586

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27586", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T17:40:28.450Z", "datePublished": "2026-02-24T16:08:20.569Z", "dateUpdated": "2026-02-26T20:56:20.526Z"}, "containers": {"cna": {"title": "Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed", "problemTypes": [{"descriptions": [{"cweId": "CWE-755", "lang": "en", "description": "CWE-755: Improper Handling of Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7"}, {"name": "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48", "tags": ["x_refsource_MISC"], "url": "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48"}, {"name": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1"}], "affected": [{"vendor": "caddyserver", "product": "caddy", "versions": [{"version": "< 2.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T16:08:20.569Z"}, "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability."}], "source": {"advisory": "GHSA-hffm-g8v7-wrv7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:55:27.670740Z", "id": "CVE-2026-27586", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:56:20.526Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27586", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T20:55:27.670740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:56:09.506Z"}}], "cna": {"title": "Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed", "source": {"advisory": "GHSA-hffm-g8v7-wrv7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "caddyserver", "product": "caddy", "versions": [{"status": "affected", "version": "< 2.11.1"}]}], "references": [{"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7", "name": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48", "name": "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1", "name": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755: Improper Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T16:08:20.569Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27586", "state": "PUBLISHED", "dateUpdated": "2026-02-26T20:56:20.526Z", "dateReserved": "2026-02-20T17:40:28.450Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T16:08:20.569Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "caddy", "vendor": "caddyserver", "versions": [{"status": "affected", "version": "< 2.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*", "matchCriteriaId": "9AD1B432-AFA3-4A05-A687-F6092CDB6498", "versionEndExcluding": "2.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability."}, {"lang": "es", "value": "Caddy es una plataforma de servidor extensible que usa TLS por defecto. Antes de la versi\u00f3n 2.11.1, dos errores silenciados en `ClientAuthentication.provision()` causan que la autenticaci\u00f3n de certificados de cliente mTLS falle silenciosamente en modo abierto cuando un archivo de certificado de CA falta, es ilegible o est\u00e1 malformado. El servidor se inicia sin error pero acepta cualquier certificado de cliente firmado por cualquier CA de confianza del sistema, eludiendo completamente el l\u00edmite de confianza de CA privada previsto. Cualquier despliegue que use `trusted_ca_cert_file` o `trusted_ca_certs_pem_files` para mTLS se degradar\u00e1 silenciosamente para aceptar cualquier certificado de cliente de confianza del sistema si el archivo de CA deja de estar disponible. Esto puede ocurrir debido a un error tipogr\u00e1fico en la ruta, rotaci\u00f3n de archivos, corrupci\u00f3n o cambios de permisos. El servidor no da ninguna indicaci\u00f3n de que mTLS est\u00e1 mal configurado. La versi\u00f3n 2.11.1 corrige la vulnerabilidad."}], "id": "CVE-2026-27586", "lastModified": "2026-06-17T10:27:20.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27586", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:55:27.670740Z", "version": "2.0.3"}}]}, "published": "2026-02-24T17:29:03.793", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit"], "url": "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "caddy", "source": "cna", "vendor": "caddyserver"}, "product": "caddy", "vendor": "caddyserver"}], "analysis": {"en": {"generated_at": "2026-04-17T15:43:02.544482+00:00", "value": {"mitigation_remediation": ["Upgrade Caddy to version 2.11.1 or later, which includes a fix for the swallowed errors in the mTLS provisioning routine.", "Verify that the trusted_ca_cert_file or trusted_ca_certs_pem_files exist, are readable, and contain correctly formatted certificates; correct any typos or permission issues promptly.", "Implement monitoring or alerting to detect missing or malformed CA certificates, and consider hardening the system CA store to limit trusted CAs to only those explicitly required by the application."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access via mTLS authentication bypass"}, "threat_synthesis": {"affected_systems": "The issue affects caddyserver\u2019s Caddy server before version 2.11.1. Any deployment that relies on the trusted_ca_cert_file or trusted_ca_certs_pem_files configuration for mTLS is susceptible if a CA file is missing due to a typo, rotation, corruption, or permission change.", "description_and_impact": "Caddy\u2019s mTLS client authentication mechanisms silently fail open when a CA certificate file is missing, unreadable, or malformed. Two swallowed errors in the ClientAuthentication.provision() routine cause the server to start without error while accepting any client certificate signed by any system\u2011trusted CA, thereby bypassing the intended private CA trust boundary. The vulnerability is a classic example of an authorization bypass flaw (CWE\u2011755). Attackers can obtain unauthorized access to services protected by mTLS if they can present any client certificate trusted by the underlying system, potentially leading to data disclosure, tampering, or denial of service.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity, while the EPSS probability of less than 1% suggests that exploitation is not yet widespread. The vulnerability does not require complex conditions; the attacker only needs to present a client certificate that the system trusts. The main risk is that any client possessing such a certificate can connect to the target, effectively bypassing the intended isolation. The vulnerability is not listed in the CISA KEV catalog, so it has no known field\u2011deployed exploitation at the time of this analysis. Prompt patching is recommended given the high impact for affected systems."}}}}, "created": "2026-02-25T11:38:42.188040+00:00", "updated": "2026-04-17T15:45:15.908714+00:00", "vendors": ["caddyserver", "caddyserver$PRODUCT$caddy"]}