Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Caddy Web Server Improper Handling of Exceptional Conditions Vulnerability - CVE-2026-27586 - Vulnerability Database
Caddy Web Server

Caddy Web Server Improper Handling of Exceptional Conditions Vulnerability - CVE-2026-27586

Critical
Reference: CVE-2026-27586
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-27586
Title: Caddy Web Server Improper Handling of Exceptional Conditions Vulnerability
Overview:

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1 two swallowed errors in ClientAuthentication.provision() cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing unreadable or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA completely bypassing the intended private CA trust boundary. Any deployment using trusted_ca_cert_file or trusted_ca_certs_pem_files for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path file rotation corruption or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.