EUVD-2026-50212
GHSA-vv89-hv6r-vgqh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N) but needs a specific UDS/ACL config to trigger (AC:H); the bypass exposes protected backend resources, so scope changes (S:C) with limited C/I impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
7DescriptionCVE.org
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Access control bypass in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to defeat IP-based access restrictions, both on Unix Domain Socket (UDS) listeners and through faulty ACL matching logic. Because ATS commonly fronts internal origin servers and management endpoints, bypassing these IP allow/deny lists can expose protected backend resources that operators believed were network-restricted. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the fix is vendor-confirmed in the Apache advisory.
Technical ContextAI
Apache Traffic Server is a high-performance caching HTTP forward and reverse proxy widely deployed at CDN and edge scale. It enforces client-source restrictions through IP ACLs (e.g. ip_allow.yaml and remap/named ACL rules) and can also expose listeners over Unix Domain Sockets. This vulnerability is classified CWE-863 (Incorrect Authorization): the ACL evaluation logic reaches an incorrect allow/deny decision for certain requests, and connections arriving via UDS listeners are not subjected to the intended IP-based controls. The affected component is the ATS proxy itself (per CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server), and the practical impact falls on the downstream/origin systems those ACLs were meant to shield rather than on ATS's own data.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which correct both the UDS listener bypass and the ACL matching error, per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Deployments still on the 8.x line have no fixed 8.x release and should migrate to a supported patched branch. Until patching, reduce reliance on ATS IP ACLs as the sole trust boundary: avoid exposing UDS listeners to untrusted clients, and enforce source-IP restrictions at an upstream network layer (firewall/security group or a fronting load balancer) so a single ACL evaluation error inside ATS does not directly expose origins - the trade-off is added operational complexity and potential duplication of allow-lists that must be kept in sync. Do not treat management or internal endpoints as protected by ATS ACLs alone until the upgrade is applied.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today