CVE-2026-27586 - Vulnerability Analysis

Overview

Caddy < 2.11.1 contains a broken authentication caused by swallowed errors in ClientAuthentication.provision() leading to silent mTLS client certificate authentication failure, letting attackers bypass private CA trust boundary, exploit requires misconfigured or missing CA certificate files.

Severity & Score

Impact

Attackers can bypass mTLS authentication, allowing unauthorized access to the server.

Mitigation

Upgrade to version 2.11.1 or later.

References

• https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48
• https://github.com/caddyserver/caddy/releases/tag/v2.11.1
• https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🔴 CVE-2026-27586 - Critical (9.1) Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is m... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27586/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner