Caddy’s mTLS client authentication mechanisms silently fail open when a CA certificate file is missing, unreadable, or malformed. Two swallowed errors in the ClientAuthentication.provision() routine cause the server to start without error while accepting any client certificate signed by any system‑trusted CA, thereby bypassing the intended private CA trust boundary. The vulnerability is a classic example of an authorization bypass flaw (CWE‑755). Attackers can obtain unauthorized access to services protected by mTLS if they can present any client certificate trusted by the underlying system, potentially leading to data disclosure, tampering, or denial of service.

The issue affects caddyserver’s Caddy server before version 2.11.1. Any deployment that relies on the trusted_ca_cert_file or trusted_ca_certs_pem_files configuration for mTLS is susceptible if a CA file is missing due to a typo, rotation, corruption, or permission change.

The CVSS score of 8.8 indicates high severity, while the EPSS probability of less than 1% suggests that exploitation is not yet widespread. The vulnerability does not require complex conditions; the attacker only needs to present a client certificate that the system trusts. The main risk is that any client possessing such a certificate can connect to the target, effectively bypassing the intended isolation. The vulnerability is not listed in the CISA KEV catalog, so it has no known field‑deployed exploitation at the time of this analysis. Prompt patching is recommended given the high impact for affected systems.