CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication

What is CVE-2018-21246?

CVE-2018-21246 is a critical authentication bypass vulnerability in n/a, published on 15 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

Weakness: CWE-287

Which versions are affected by CVE-2018-21246?

3 open source packages ship an affected version, including github.com/caddyserver/caddy and github.com/mholt/caddy. It affects 1 product.

Products include Caddyserver Caddy.

How do I fix CVE-2018-21246?

Upgrade github.com/caddyserver/caddy to 0.10.13 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-21246 being exploited?

There is no known exploitation of CVE-2018-21246 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport High 8.9
• CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed High 8.8
• CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files High 8.1
• CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` High 8.1
• CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gr7w-x2jp-3xgw, GO-2020-0043.