Improper Certificate Validation

🗓️ 03 May 2026 16:52:24Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 5 Views

Caddy improper certificate validation allows mTLS to accept any client certificate signed by a system trusted certificate authority.

Reporter	Title	Published	Views	Family All 117
AlpineLinux	CVE-2026-27586	24 Feb 202616:08	–	alpinelinux
Circl	CVE-2026-27586	23 Feb 202604:24	–	circl
CNNVD	Caddy 安全漏洞	24 Feb 202600:00	–	cnnvd
CVE	CVE-2026-27586	24 Feb 202616:08	–	cve
Cvelist	CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed	24 Feb 202616:08	–	cvelist
Debian CVE	CVE-2026-27586	24 Feb 202616:08	–	debiancve
Github Security Blog	Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed	24 Feb 202620:22	–	github
NVD	CVE-2026-27586	24 Feb 202617:29	–	nvd
OSV	CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed	24 Feb 202616:08	–	osv
OSV	DEBIAN-CVE-2026-27586	24 Feb 202617:29	–	osv

Vulners

Node

caddy_project caddyMatch2.10.0-r1go

AND

caddy_project caddyMatch2.4.2-r0go

AND

caddy_project caddyMatch2.5.0-r0go

AND

caddy_project caddyMatch2.7.6-r5go

AND

caddy_project caddyMatch2.4.1-r1go

AND

caddy_project caddyMatch2.7.6-r0go

AND

caddy_project caddyMatch2.8.4-r0go

AND

caddy_project caddyMatch2.4.1-r0go

AND

caddy_project caddyMatch2.6.4-r5go

AND

caddy_project caddyMatch2.7.3-r0go

AND

caddy_project caddyMatch1.0.4-r3go

AND

caddy_project caddyMatch2.10.0-r3go

AND

caddy_project caddyMatch1.0.4-r2go

AND

caddy_project caddyMatch2.4.3-r0go

AND

caddy_project caddyMatch2.6.4-r6go

AND

caddy_project caddyMatch2.5.1-r0go

AND

caddy_project caddyMatch2.9.1-r0go

AND

caddy_project caddyMatch2.9.1-r1go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.3.0-r0go

AND

caddy_project caddyMatch2.6.4-r3go

AND

caddy_project caddyMatch2.6.4-r4go

AND

caddy_project caddyMatch2.4.5-r0go

AND

caddy_project caddyMatch2.6.1-r0go

AND

caddy_project caddyMatch2.4.6-r2go

AND

caddy_project caddyMatch2.7.4-r0go

AND

caddy_project caddyMatch2.10.0-r0go

AND

caddy_project caddyMatch2.10.2-r0go

AND

caddy_project caddyMatch2.7.6-r7go

AND

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.8.4-r2go

AND

caddy_project caddyMatch2.6.3-r0go

AND

caddy_project caddyMatch2.6.4-r1go

AND

caddy_project caddyMatch2.7.6-r2go

AND

caddy_project caddyMatch2.7.6-r4go

AND

caddy_project caddyMatch2.5.1-r1go

AND

caddy_project caddyMatch2.5.2-r1go

AND

caddy_project caddyMatch2.9.1-r2go

AND

caddy_project caddyMatch2.10.0-r2go

AND

caddy_project caddyMatch2.6.1-r1go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.7.4-r1go

AND

caddy_project caddyMatch2.5.2-r0go

AND

caddy_project caddyMatch2.4.6-r0go

AND

caddy_project caddyMatch2.6.4-r2go

AND

caddy_project caddyMatch2.6.2-r1go

AND

caddy_project caddyMatch2.8.4-r3go

AND

caddy_project caddyMatch2.5.2-r2go

AND

caddy_project caddyMatch2.5.2-r3go

AND

caddy_project caddyMatch2.7.6-r6go

AND

caddy_project caddyMatch2.6.2-r2go

AND

caddy_project caddyMatch2.10.2-r4go

AND

caddy_project caddyMatch2.7.5-r0go

AND

caddy_project caddyMatch2.7.6-r1go

AND

caddy_project caddyMatch2.6.0-r0go

AND

caddy_project caddyMatch2.6.2-r3go

AND

caddy_project caddyMatch2.6.2-r0go

AND

caddy_project caddyMatch2.7.6-r3go

AND

caddy_project caddyMatch2.4.0-r0go

AND

caddy_project caddyMatch2.4.5-r1go

AND

caddy_project caddyMatch2.4.6-r3go

AND

caddy_project caddyMatch2.9.1-r3go

AND

caddy_project caddyMatch2.8.4-r1go

AND

alpinelinux alpine_linuxMatchedge

caddy_project caddyMatch2.10.2-r5go

AND

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.10.2-r4go

AND

alpinelinux alpine_linuxMatch3.23

caddyserver github.com/caddyserver/caddyRangev2.0.0-beta1–2.0.0-beta1go

Source	Link
github	www.github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7
github	www.github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72
secdb	www.secdb.alpinelinux.org/v3.23/community.yaml
secdb	www.secdb.alpinelinux.org/edge/community.yaml

15 May 2026 14:27Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

CVSS 49.3

EPSS0.00267

SSVC