Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in ClientAuthentication.provision() cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using trusted_ca_cert_file or trusted_ca_certs_pem_files for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/caddyserver/caddy/v2Go | < 2.11.1 | 2.11.1 |
Affected products
1Patches
1d42d39b4bc23caddytls: Return errors instead of nil in client auth provisioning (#7464)
1 file changed · +2 −2
modules/caddytls/connpolicy.go+2 −2 modified@@ -784,7 +784,7 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error { for _, fpath := range clientauth.TrustedCACertPEMFiles { ders, err := convertPEMFilesToDER(fpath) if err != nil { - return nil + return err } clientauth.TrustedCACerts = append(clientauth.TrustedCACerts, ders...) } @@ -797,7 +797,7 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error { } err := caPool.Provision(ctx) if err != nil { - return nil + return err } clientauth.ca = caPool }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/advisories/GHSA-hffm-g8v7-wrv7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27586ghsaADVISORY
- gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48ghsax_refsource_MISCWEB
- github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72ghsaWEB
- github.com/caddyserver/caddy/releases/tag/v2.11.1ghsax_refsource_MISCWEB
- github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7ghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2026-4539ghsaWEB
News mentions
0No linked articles in our index yet.