CVE-2026-27586: Caddy MTLS Client Authentication Silently Fails Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hffm-g8v7-wrv7",
  "modified" : "2026-02-27T19:52:41Z",
  "published" : "2026-02-24T20:22:53Z",
  "aliases" : [ "CVE-2026-27586" ],
  "summary" : "Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed",
  "details" : "### Summary\n\nTwo swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary.\n\n### Details\n\nIn `modules/caddytls/connpolicy.go`, the `provision()` method has two `return nil` statements that should be `return err`:\n\n**Bug #1 — line 787:**\n```go\nders, err := convertPEMFilesToDER(fpath)\nif err != nil {\n    return nil  // BUG: should be \"return err\"\n}\n```\n\n**Bug #2 — line 800:**\n```go\nerr := caPool.Provision(ctx)\nif err != nil {\n    return nil  // BUG: should be \"return err\"\n}\n```\n\nCompare with line 811 which correctly returns the error:\n```go\ncaRaw, err := ctx.LoadModule(clientauth, \"CARaw\")\nif err != nil {\n    return err  // CORRECT\n}\n```\n\nWhen the error is swallowed on line 787, the chain is:\n\n1. `TrustedCACerts` remains empty (no DER data appended from the file)\n2. The `len(clientauth.TrustedCACerts) > 0` guard on line 794 is false — skipped\n3. `clientauth.CARaw` is nil — line 806 returns nil\n4. `clientauth.ca` remains nil — no CA pool was created\n5. `provision()` returns nil — caller thinks provisioning succeeded\n\nThen in `ConfigureTLSConfig()`:\n\n6. `Active()` returns true because `TrustedCACertPEMFiles` is non-empty\n7. Default mode is set to `RequireAndVerifyClientCert` (line 860)\n8. But `clientauth.ca` is nil, so `cfg.ClientCAs` is never set (line 867 skipped)\n9. Go's `crypto/tls` with `RequireAndVerifyClientCert` + nil `ClientCAs` verifies client certs against the **system root pool** instead of the intended CA\n\nThe fix is changing `return nil` to `return err` on lines 787 and 800.\n\n### PoC\n\n1. Configure Caddy with mTLS pointing to a nonexistent CA file:\n\n```\n{\n    \"apps\": {\n        \"http\": {\n            \"servers\": {\n                \"srv0\": {\n                    \"listen\": [\":443\"],\n                    \"tls_connection_policies\": [{\n                        \"client_authentication\": {\n                            \"trusted_ca_certs_pem_files\": [\"/nonexistent/ca.pem\"]\n                        }\n                    }]\n                }\n            }\n        }\n    }\n}\n```\n\n2. Start Caddy — it starts without any error or warning.\n\n3. Connect with any client certificate (even self-signed):\n```bash\nopenssl s_client -connect localhost:443 -cert client.pem -key client-key.pem\n```\n\n4. The TLS handshake succeeds despite the certificate not being signed by the intended CA.\n\nA full Go test that proves the bug end-to-end (including a successful TLS handshake with a random self-signed client cert) is here: https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48\n\nTest output:\n```\n=== RUN   TestSwallowedErrorMTLSFailOpen\n    BUG CONFIRMED: provision() swallowed the error from a nonexistent CA file.\n    tls.Config has RequireAndVerifyClientCert but ClientCAs is nil.\n    CRITICAL: TLS handshake succeeded with a self-signed client cert!\n    The server accepted a client certificate NOT signed by the intended CA.\n--- PASS: TestSwallowedErrorMTLSFailOpen (0.03s)\n```\n\n### Impact\n\nAny deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/caddyserver/caddy/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.11.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-27586"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72"
  }, {
    "type" : "WEB",
    "url" : "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/caddyserver/caddy"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/caddyserver/caddy/releases/tag/v2.11.1"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2026-4539"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-755" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-24T20:22:53Z",
    "nvd_published_at" : "2026-02-24T17:29:03Z"
  }
}