Apache Traffic Server CVE-2026-22068

Exploitation requires that the target Apache Traffic Server instance uses one or more regular expression rules - in remap.config, ACL plugins, or header-rewriting configurations - where the pattern is applied to request URIs, hostnames, or headers for a security enforcement decision and lacks proper anchoring. Default ATS configurations with no regex-based access control are not vulnerable to the authorization bypass; the flaw only materializes when regex rules are actively used as security gatekeepers. No authentication is required (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L) once the regex pattern structure is known or guessed. Exploitation is limited to confidentiality breach (C:H) and minor integrity bypass (I:L); availability is not impacted.

The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) accurately reflects a remotely exploitable, low-complexity, unauthenticated path to high confidentiality impact. The attack vector is purely network-based with no privileges or user interaction required, making this accessible to any actor capable of sending HTTP requests. The I:L metric suggests limited but non-zero write-path bypass - for example, permitting a write to a path that should be read-only under the regex policy. No EPSS score was provided in the input data; given that no POC and no KEV listing exist at time of analysis, real-world exploitation probability is lower than the CVSS score alone suggests, but the simplicity of the attack class (substring embedding in a request) means weaponization would be trivial once an attacker identifies the specific unanchored pattern in use. The actual risk is highly deployment-dependent: installations using ATS regex rules for security enforcement (access control, content gating) are materially exposed, while installations relying on network-layer ACLs or not using regex-driven policies face limited exposure from this specific flaw.

An attacker targeting an ATS deployment that uses an unanchored regex such as /^secret/ to gate access to a protected upstream path sends a crafted HTTP request for a URI like /public/secret/data - because the pattern matches the substring 'secret' without anchoring at the right position, ATS evaluates the request as policy-compliant and forwards it to the protected upstream, returning confidential content to the unauthenticated attacker. No public exploit code exists at time of analysis, but the technique requires only knowledge of the target regex pattern and the ability to embed it as a substring in a crafted request path or header.