caddyserver caddy up to 2.11.0 CA File ClientAuthentication.provision exceptional condition

Summaryinfo

A vulnerability classified as critical has been found in caddyserver caddy up to 2.11.0. This affects the function ClientAuthentication.provision of the component CA File Handler. Performing a manipulation results in exceptional condition. This vulnerability is cataloged as CVE-2026-27586. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in caddyserver caddy up to 2.11.0. This affects the function ClientAuthentication.provision of the component CA File Handler. The manipulation with an unknown input leads to a exceptional condition vulnerability. CWE is classifying the issue as CWE-755. The product does not handle or incorrectly handles an exceptional condition. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-27586 since 02/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 300012 (Linux Distros Unpatched Vulnerability : CVE-2026-27586), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.11.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (300012). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• caddyserver

Name

• caddy

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11.0

Website

• Product: https://github.com/caddyserver/caddy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion