Improper Certificate Validation

🗓️ 03 May 2026 16:52:24Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 12 Views

Caddy improper certificate validation allows mTLS to accept any client certificate signed by a system trusted certificate authority.

Reporter	Title	Published	Views	Family All 120
ATTACKERKB	CVE-2026-27586	24 Feb 202616:08	–	attackerkb
AlpineLinux	CVE-2026-27586	24 Feb 202616:08	–	alpinelinux
Circl	CVE-2026-27586	23 Feb 202604:24	–	circl
CNNVD	Caddy 安全漏洞	24 Feb 202600:00	–	cnnvd
CVE	CVE-2026-27586	24 Feb 202616:08	–	cve
Cvelist	CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed	24 Feb 202616:08	–	cvelist
Debian CVE	CVE-2026-27586	24 Feb 202616:08	–	debiancve
Fedora	[SECURITY] Fedora 44 Update: caddy-2.10.2-9.fc44	2 Jul 202601:11	–	fedora
Fedora	[SECURITY] Fedora 43 Update: caddy-2.10.2-9.fc43	2 Jul 202601:12	–	fedora
Tenable Nessus	Fedora 43 : caddy (2026-3dc324bd9a)	1 Jul 202600:00	–	nessus

Vulners

Node

caddy_project caddyMatch2.10.0-r1go

AND

caddy_project caddyMatch2.4.2-r0go

AND

caddy_project caddyMatch2.5.0-r0go

AND

caddy_project caddyMatch2.7.6-r5go

AND

caddy_project caddyMatch2.4.1-r1go

AND

caddy_project caddyMatch2.7.6-r0go

AND

caddy_project caddyMatch2.8.4-r0go

AND

caddy_project caddyMatch2.4.1-r0go

AND

caddy_project caddyMatch2.6.4-r5go

AND

caddy_project caddyMatch2.7.3-r0go

AND

caddy_project caddyMatch1.0.4-r3go

AND

caddy_project caddyMatch2.10.0-r3go

AND

caddy_project caddyMatch1.0.4-r2go

AND

caddy_project caddyMatch2.4.3-r0go

AND

caddy_project caddyMatch2.6.4-r6go

AND

caddy_project caddyMatch2.5.1-r0go

AND

caddy_project caddyMatch2.9.1-r0go

AND

caddy_project caddyMatch2.9.1-r1go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.3.0-r0go

AND

caddy_project caddyMatch2.6.4-r3go

AND

caddy_project caddyMatch2.6.4-r4go

AND

caddy_project caddyMatch2.4.5-r0go

AND

caddy_project caddyMatch2.6.1-r0go

AND

caddy_project caddyMatch2.4.6-r2go

AND

caddy_project caddyMatch2.7.4-r0go

AND

caddy_project caddyMatch2.10.0-r0go

AND

caddy_project caddyMatch2.10.2-r0go

AND

caddy_project caddyMatch2.7.6-r7go

AND

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.8.4-r2go

AND

caddy_project caddyMatch2.6.3-r0go

AND

caddy_project caddyMatch2.6.4-r1go

AND

caddy_project caddyMatch2.7.6-r2go

AND

caddy_project caddyMatch2.7.6-r4go

AND

caddy_project caddyMatch2.5.1-r1go

AND

caddy_project caddyMatch2.5.2-r1go

AND

caddy_project caddyMatch2.9.1-r2go

AND

caddy_project caddyMatch2.10.0-r2go

AND

caddy_project caddyMatch2.6.1-r1go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.7.4-r1go

AND

caddy_project caddyMatch2.5.2-r0go

AND

caddy_project caddyMatch2.4.6-r0go

AND

caddy_project caddyMatch2.6.4-r2go

AND

caddy_project caddyMatch2.6.2-r1go

AND

caddy_project caddyMatch2.8.4-r3go

AND

caddy_project caddyMatch2.5.2-r2go

AND

caddy_project caddyMatch2.5.2-r3go

AND

caddy_project caddyMatch2.7.6-r6go

AND

caddy_project caddyMatch2.6.2-r2go

AND

caddy_project caddyMatch2.10.2-r4go

AND

caddy_project caddyMatch2.7.5-r0go

AND

caddy_project caddyMatch2.7.6-r1go

AND

caddy_project caddyMatch2.6.0-r0go

AND

caddy_project caddyMatch2.6.2-r3go

AND

caddy_project caddyMatch2.6.2-r0go

AND

caddy_project caddyMatch2.7.6-r3go

AND

caddy_project caddyMatch2.4.0-r0go

AND

caddy_project caddyMatch2.4.5-r1go

AND

caddy_project caddyMatch2.4.6-r3go

AND

caddy_project caddyMatch2.9.1-r3go

AND

caddy_project caddyMatch2.8.4-r1go

AND

alpinelinux alpine_linuxMatchedge

caddy_project caddyMatch2.10.2-r5go

AND

caddy_project caddyMatch2.10.2-r1go

AND

caddy_project caddyMatch2.10.2-r3go

AND

caddy_project caddyMatch2.10.2-r2go

AND

caddy_project caddyMatch2.10.2-r4go

AND

alpinelinux alpine_linuxMatch3.23

caddyserver github.com/caddyserver/caddyRangev2.0.0-beta1–2.0.0-beta1go

Source	Link
github	www.github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7
github	www.github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72
secdb	www.secdb.alpinelinux.org/v3.23/community.yaml
secdb	www.secdb.alpinelinux.org/edge/community.yaml
github	www.github.com/caddyserver/caddy/releases/tag/v2.11.1
gist	www.gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48

23 Jun 2026 16:34Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

CVSS 49.3

EPSS0.00267

SSVC