CVE-2018-21246: Caddyserver Caddy

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

Affected products

• Caddyserver Caddy: before 0.10.3 (fixed in 0.10.3)

Published 2020-06-15. Last modified 2026-06-17.