Caddy
CVE-2026-27586
CRITICAL
GHSA-hffm-g8v7-wrv7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConfigure mTLS with missing CA certificate file
-
ExploitServer silently fails to load private CA
-
ExecutionAccept any system-trusted client certificate
-
ImpactBypass authentication boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling procedures
|
| Exploitation Conditions | Caddy deployment using |
| Impact | CVSS 9.1. Caddy is a major web server — client certificate auth bypass affects mTLS deployments. |
| Exploit ScenarioDerived | Attacker presents invalid client certificate to Caddy server configured for mTLS, certificate validation error is swallowed, attacker gains access to protected resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in ClientCAs handling are silenced, potentially accepting invalid client certificates. PoC available.
Earlier versions of this analysis (1)
Swallowed TLS errors in Caddy bypass client cert auth.
RemediationAI
Update to Caddy 2.11.1. Verify mTLS configurations are properly enforcing certificate validation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-755 improper handling of exceptional conditions. Two error paths in ClientHelloInfo and ClientAuth handling are silently ignored, potentially accepting connections that should be rejected.
Know when Caddy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in ClientAuthentication.provision() cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using trusted_ca_cert_file or trusted_ca_certs_pem_files for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.
Executive ViewAI
Caddy servers prior to version 2.11.1 fail silently when mutual TLS (mTLS) client certificate validation encounters errors, allowing unauthorized clients to bypass authentication entirely. Organizations using Caddy for API gateways, microservices, or internal service authentication face immediate risk of unauthorized access if CA certificate configurations are missing, corrupted, or misconfigured.
Until patch is available: (1) Implement network segmentation to restrict access to Caddy servers from only trusted client networks; (2) Deploy WAF rules on upstream proxies to inspect TLS client certificates and reject unauthenticated connections; (3) Add monitoring and alerting on Caddy logs for authentication errors or certificate validation warnings; (4) Temporarily disable mTLS and rely on alternative authentication (API keys, OAuth) if risk tolerance is low; (5) Validate CA certificate files are present and readable via automated health checks before deployment; (6) Implement IP allowlisting in addition to mTLS as compensating network control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to
Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casi
Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using altern
Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e
Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers
A configuration-gated information-disclosure flaw in Caddy 2.11.3 and earlier allows an unauthenticated remote attacker
Caddy versions prior to 2.11.1 fail to sanitize backslashes in file path matching, allowing attackers to bypass path-bas
Caddy versions prior to 2.11.1 allow unauthenticated cross-origin requests to the admin API when origin enforcement is d
An issue was discovered in caddy (for TYPO3) before 7.2.10. Rated medium severity (CVSS 6.1), this vulnerability is remo
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumer
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB