{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/caddyserver/caddy/v2/modules/caddytls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27586"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-24T20:22:53Z",
    "nvd_published_at": "2026-02-24T17:29:03Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nTwo swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary.\n\n### Details\n\nIn `modules/caddytls/connpolicy.go`, the `provision()` method has two `return nil` statements that should be `return err`:\n\n**Bug #1 \u2014 line 787:**\n```go\nders, err := convertPEMFilesToDER(fpath)\nif err != nil {\n    return nil  // BUG: should be \"return err\"\n}\n```\n\n**Bug #2 \u2014 line 800:**\n```go\nerr := caPool.Provision(ctx)\nif err != nil {\n    return nil  // BUG: should be \"return err\"\n}\n```\n\nCompare with line 811 which correctly returns the error:\n```go\ncaRaw, err := ctx.LoadModule(clientauth, \"CARaw\")\nif err != nil {\n    return err  // CORRECT\n}\n```\n\nWhen the error is swallowed on line 787, the chain is:\n\n1. `TrustedCACerts` remains empty (no DER data appended from the file)\n2. The `len(clientauth.TrustedCACerts) \u003e 0` guard on line 794 is false \u2014 skipped\n3. `clientauth.CARaw` is nil \u2014 line 806 returns nil\n4. `clientauth.ca` remains nil \u2014 no CA pool was created\n5. `provision()` returns nil \u2014 caller thinks provisioning succeeded\n\nThen in `ConfigureTLSConfig()`:\n\n6. `Active()` returns true because `TrustedCACertPEMFiles` is non-empty\n7. Default mode is set to `RequireAndVerifyClientCert` (line 860)\n8. But `clientauth.ca` is nil, so `cfg.ClientCAs` is never set (line 867 skipped)\n9. Go\u0027s `crypto/tls` with `RequireAndVerifyClientCert` + nil `ClientCAs` verifies client certs against the **system root pool** instead of the intended CA\n\nThe fix is changing `return nil` to `return err` on lines 787 and 800.\n\n### PoC\n\n1. Configure Caddy with mTLS pointing to a nonexistent CA file:\n\n```\n{\n    \"apps\": {\n        \"http\": {\n            \"servers\": {\n                \"srv0\": {\n                    \"listen\": [\":443\"],\n                    \"tls_connection_policies\": [{\n                        \"client_authentication\": {\n                            \"trusted_ca_certs_pem_files\": [\"/nonexistent/ca.pem\"]\n                        }\n                    }]\n                }\n            }\n        }\n    }\n}\n```\n\n2. Start Caddy \u2014 it starts without any error or warning.\n\n3. Connect with any client certificate (even self-signed):\n```bash\nopenssl s_client -connect localhost:443 -cert client.pem -key client-key.pem\n```\n\n4. The TLS handshake succeeds despite the certificate not being signed by the intended CA.\n\nA full Go test that proves the bug end-to-end (including a successful TLS handshake with a random self-signed client cert) is here: https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48\n\nTest output:\n```\n=== RUN   TestSwallowedErrorMTLSFailOpen\n    BUG CONFIRMED: provision() swallowed the error from a nonexistent CA file.\n    tls.Config has RequireAndVerifyClientCert but ClientCAs is nil.\n    CRITICAL: TLS handshake succeeded with a self-signed client cert!\n    The server accepted a client certificate NOT signed by the intended CA.\n--- PASS: TestSwallowedErrorMTLSFailOpen (0.03s)\n```\n\n### Impact\n\nAny deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured.",
  "id": "GHSA-hffm-g8v7-wrv7",
  "modified": "2026-02-24T20:22:53Z",
  "published": "2026-02-24T20:22:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27586"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/caddyserver/caddy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed"
}