Which versions of Apache Traffic Server are affected by CVE-2026-58186?

Apache Traffic Server's webp_transform plugin (versions 8.x-10.1.3) contains a cache poisoning flaw allowing remote attackers to corrupt cached content and serve mislabeled responses to all…

How to fix or mitigate CVE-2026-58186?

Within 24 hours: identify all systems running Apache Traffic Server 8.x-10.1.3 with webp_transform plugin enabled; disable the plugin immediately if not business-critical. Within 7 days: for systems where the plugin must remain active, deploy WAF rules to restrict webp requests and implement cache monitoring for content-type mismatches. Within 30 days: track vendor patch release (expected versions 8.2.0+, 9.2.15+, 10.1.4+), evaluate alternative image transformation solutions, and prepare upgrade procedures to deploy patches immediately upon availability.

Apache Traffic Server CVE-2026-58186

Q: What is the CVSS score of CVE-2026-58186?

CVE-2026-58186 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50231 HIGH

Improper Input Validation (CWE-20)

2026-07-29 apache

GHSA-fr5w-2rg3-6qp3

Apache Information Disclosure Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N) but the AT:P precondition and optional-plugin dependency justify AC:H; mislabeled cached content gives I:L and unsafe decode/serving gives A:H, no confidentiality.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:54 vuln.today

CVE Published

Jul 29, 2026 - 09:01 cve.org

MEDIUM 7.5

DescriptionCVE.org

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Cache poisoning and content-type confusion in the Apache Traffic Server webp_transform plugin allows remote clients to induce the proxy to decode images unsafely and store mislabeled, cacheable responses that are then served to other users. Affected releases span the 8.x (through 8.1.9), 9.x (through 9.2.14), and 10.x (through 10.1.3) branches when the optional webp_transform plugin is enabled. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided, so risk here is driven by the CVSS 8.2 (CVSS 4.0) rating rather than observed exploitation.

Technical ContextAI

Apache Traffic Server is a high-performance forward and reverse caching HTTP proxy widely used as a CDN edge and origin-offload layer. The flaw lives in the webp_transform plugin, an optional transform module that re-encodes upstream images into WebP on the fly to reduce bandwidth. The root cause is classed as CWE-20 (Improper Input Validation): the plugin decodes image input unsafely and produces responses whose labeling (e.g., content type/cacheability metadata) does not match the actual payload, and because those responses are marked cacheable they can be stored and re-served. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server:*:*:*:*:*:*:*:* identifies the affected product; the defect is specific to deployments that load and configure the webp_transform plugin, not to a base ATS install.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), as directed in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d; note the 8.x branch has no listed fixed release, so 8.x operators should migrate to a fixed 9.2.15+ or 10.1.4+ build. If immediate upgrade is not possible, disable or unload the webp_transform plugin from remap/plugin configuration, which fully removes the vulnerable code path at the cost of losing on-the-fly WebP transcoding (increased bandwidth/origin load). As an interim compensating control, tighten cache behavior for transformed image responses - for example, disable caching of webp_transform output or add cache-key/Vary and content-type validation at the edge - accepting the cache-hit-ratio penalty this imposes.