Apache Traffic Server CVE-2026-58186

Exploitation requires that the target Apache Traffic Server instance has the optional webp_transform plugin loaded and configured to transform image responses - a base ATS deployment without this plugin is not affected. The CVSS 4.0 vector marks AT:P (attack requirement present), indicating a specific precondition such as attacker influence over the image content being decoded or a particular decode/caching condition, so it is not fire-and-forget. No authentication is required (PR:N) and no user interaction (UI:N), and the vector is network-reachable (AV:N). Limiting factors: the affected plugin is not enabled by default, exploitation hinges on the caching path storing and re-serving the mislabeled response, and the rated impact is availability/cache-integrity rather than direct code execution or data theft.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 (High): network-reachable, low complexity, no privileges or user interaction, but crucially AT:P - a present attack requirement - meaning exploitation is not fully unconditional and depends on specific conditions/timing plus the plugin being enabled. The rated impact is availability-only (VA:H) with no stated confidentiality or integrity impact, though the description of 'mislabeled, cacheable responses' suggests a cache-integrity/content-confusion dimension that the numeric vector arguably under-weights - worth verifying with the vendor. No EPSS, KEV, or POC signals were provided, so there is no evidence of active exploitation or public exploit code. Net: this is a real, patch-worthy issue for shops actually running webp_transform, but the AT:P requirement and the optional-plugin dependency make it a targeted/conditional risk rather than a mass-exploitable default-config flaw; deprioritize relative to unauthenticated RCEs but patch on a normal cadence.

An attacker who can get the proxy to fetch and transform an attacker-influenced or malformed image causes the webp_transform plugin to emit a mislabeled, cacheable response; that poisoned entry is then served from cache to subsequent legitimate clients, degrading availability or delivering content that does not match its declared type. No public exploit code is identified at time of analysis, and the CVSS 4.0 AT:P requirement means the attacker must satisfy a specific condition (such as controlling the transformed input or hitting a particular decode path) rather than firing a single unconditional request.