Apache Traffic Server CVE-2026-58156

Exploitation requires network access to an Apache Traffic Server instance with at least low-privilege authenticated access (PR:L per CVSS). The critical enabling condition is that the ATS deployment must be configured with port-based access control rules - installations that do not use port-based ACLs are not impacted by the bypass, though they still run vulnerable code. The specific trigger involves crafting a URL with a malformed port in the URL authority or userinfo component that causes the ATS parser to read a different port value than the ACL engine evaluates. Attack complexity is rated High (AC:H), meaning casual or automated scanning-level exploitation is unlikely without specific knowledge of ATS parsing internals. No user interaction is required. Exploitation is constrained to limited confidentiality and integrity effects (C:L/I:L) - full system compromise or denial of service are not indicated. Branch 8.x operators face the additional constraint of no available patch from the vendor.

The vendor-assigned CVSS 4.9 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N accurately represents a nuanced threat profile. High attack complexity (AC:H) indicates that exploitation is non-trivial and likely requires precise knowledge of ATS URL parsing edge cases, limiting opportunistic exploitation. The low privilege requirement (PR:L) means some form of authenticated proxy access is a prerequisite, further constraining the attacker population. However, the Changed scope (S:C) is the most operationally significant signal: a successful bypass extends ATS's trust boundary to backend systems that were intended to be port-restricted, meaning the real blast radius depends on what services are running on those blocked ports. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from this source. Neither a KEV listing nor public POC code is present in the provided intelligence, indicating this is a patching-priority issue rather than an emergency response. Deployments that do not enforce port-based ACLs in ATS face no functional impact from this specific flaw, though they still run vulnerable software.

An attacker with low-privilege access to an ATS proxy instance crafts a request URI containing a malformed port value embedded in the userinfo component or host:port field - for example, encoding a target port in a way that ATS's parser interprets differently from the ACL engine. ATS evaluates the ACL against the mis-parsed (and permitted) port, forwards the request to the actual restricted backend port, and returns the response to the attacker. No public POC is available at time of analysis, and the high attack complexity implies that discovering the specific malformed URL form requires non-trivial research or access to ATS source code parsing behavior.