Apache Traffic Server CVE-2026-58159

Exploitation targets ATS deployments that enforce access control via IP-based ACLs and/or expose Unix Domain Socket (UDS) listeners - the bypass manifests specifically on UDS listeners (which do not apply the intended IP controls) and via incorrect ACL match evaluation. The CVSS AT:P flag confirms a required attack precondition, so this is not universally reachable: an environment that does not rely on ATS IP ACLs as a security boundary and does not expose UDS listeners has little to gain from the flaw. Limiting factors are the specific listener/ACL configuration rather than authentication (PR:N) or user interaction (UI:N), and impact is on protected backend resources, not on ATS itself.

The vendor-supplied CVSS 4.0 base score is 7.0 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and notably VC:N/VI:N/VA:N but SC:H/SI:H - i.e. no direct impact to ATS itself, but High confidentiality and integrity impact to subsequent (backend) systems, which is exactly the signature of an access-control bypass exposing protected resources. AT:P indicates a specific attack requirement or precondition (such as a UDS listener being in use or an ACL configuration that trips the matching error), so this is not a guaranteed hit against every default deployment. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; the absence of KEV/POC suggests this is a real but not currently mass-exploited priority. The main caveat: real-world exposure depends heavily on whether an operator relies on ATS IP ACLs or UDS listeners as a security boundary - verify configuration before ranking urgency.

An attacker whose source IP should be blocked crafts requests that either traverse a UDS listener or hit the flawed ACL matching path, causing ATS to treat the connection as permitted. With the IP restriction defeated, the attacker reaches an origin service, admin/remap route, or internal endpoint that operators assumed was reachable only from allow-listed addresses. No public exploit code is identified at this time, and success depends on the target actually using the affected UDS/ACL configurations.