Skip to main content

Apache Traffic Server CVE-2026-41920

| EUVDEUVD-2026-50167 HIGH
Improper Access Control (CWE-284)
2026-07-29 apache GHSA-cjg7-6cv5-8fpp
Apache Authentication Bypass Apache Traffic Server
7.0
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.7 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but the attack requirement raises complexity (AC:H); the bypass affects fronted backends, so scope changes (S:C) with high C/I and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 29, 2026 - 08:34 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 29, 2026 - 08:22 vuln.today
cvss_changed
Severity Changed
Jul 29, 2026 - 08:22 NVD
MEDIUM HIGH
CVSS changed
Jul 29, 2026 - 08:22 NVD
9.3 (MEDIUM) 7.0 (HIGH)
Analysis Generated
Jul 29, 2026 - 08:18 vuln.today
CVE Published
Jul 29, 2026 - 07:18 cve.org
MEDIUM 9.3

DescriptionCVE.org

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

AnalysisAI

Access control bypass in Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3 lets remote unauthenticated attackers subvert authorization enforcement at the proxy, tagged by Apache as an authentication bypass (CWE-284). Because Traffic Server acts as a caching/reverse proxy, the flaw's impact lands on backend systems it fronts rather than on the proxy process itself. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed ATS proxy over network
Delivery
Send crafted request triggering access-control flaw
Exploit
Bypass authorization enforcement
Execution
Reach protected backend resource
Impact
Expose or alter downstream data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network access to a running Apache Traffic Server instance (9.0.0-9.1.14 or 10.0.0-10.1.3) and, per the CVSS 4.0 attack requirement (AT:P), a specific server-side condition outside the attacker's control that must hold for the access-control bypass to succeed; the supplied advisory reference does not enumerate that exact condition, so it must be confirmed from the Apache thread (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 7.0 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) issue, tempered by an attack requirement (AT:P) indicating some non-attacker-controlled condition must hold for exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach an exposed Apache Traffic Server instance sends crafted requests that exploit the improper access-control check, causing the proxy to grant access it should have denied and forward or expose requests to protected backend resources. Given AV:N/AC:L/PR:N, the request path requires no authentication or user interaction, though the AT:P attack requirement means a specific server-side condition must be present. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.1.15 (for the 9.x line) or 10.1.4 (for the 10.x line), as specified in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all deployments of Apache Traffic Server versions 9.0.0-9.1.14 and 10.0.0-10.1.3 across your infrastructure and enable detailed request logging to establish baseline traffic patterns. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58161 CRITICAL
9.2 Jul 29

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
CVE-2026-58154 CRITICAL
9.2 Jul 29

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
CVE-2026-58155 CRITICAL
9.2 Jul 29

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58162 HIGH
8.4 Jul 29

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58180 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-41920 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy