Most recent entries from all

EUVD-2026-273586

fkie_cve-2026-27586

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.

GHSA-hffm-g8v7-wrv7 — Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed

Affected: Go: github.com/caddyserver/caddy/v2

### Summary

Two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary.

### Details

In `modules/caddytls/connpolicy.go`, the `provision()` method has two `return nil` statements that should be `return err`:

**Bug #1 — line 787:** ```go ders, err := convertPEMFilesToDER(fpath) if err != nil { return nil // BUG: should be "return err" } ```

**Bug #2 — line 800:** ```go err := caPool.Provision(ctx) if err != nil { return nil // BUG: should be "return err" } ```

Compare with line 811 which correctly returns the error: ```go caRaw, err := ctx.LoadModule(clientauth, "CARaw") if err != nil { return err // CORRECT } ```

When the error is swallowed on line 787, the chain is:

1. `TrustedCACerts` remains empty (no DER data appended from the file) 2. The `len(clientauth.TrustedCACerts) > 0` guard on line 794 is false — skipped 3. `clientauth.CARaw` is nil — line 806 returns nil 4. `clientauth.ca` remains nil — no CA pool was created 5. `provision()` returns nil — caller thinks provisioning succeeded

Then in `ConfigureTLSConfig()`:

6. `Active()` returns true because `TrustedCACertPEMFiles` is non-empty 7. Default mode is set to `RequireAndVerifyClientCert` (line 860) 8. But `c…

UBUNTU-CVE-2026-27586

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy