Apache Traffic Server EUVD-2026-107536

Exploitation requires that Apache Traffic Server be deployed with the origin_server_auth plugin enabled and configured to sign origin requests with AWS credentials - this is the exact feature named in the advisory and is not part of a default ATS configuration. Given the plugin is active, the attacker needs only network access to send a crafted request as a client (PR:N/UI:N), with no authentication or user interaction. The primary limiting factor is the non-default plugin requirement (reflected as AT:P in the vendor vector); environments not using AWS origin authentication through this plugin are not exposed. Running an unaffected/patched version (9.2.16, 10.1.5, or 10.2.1) also eliminates exposure.

The vendor-supplied CVSS 4.0 base score is 7.0 (High), and the vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with low attack complexity but a present attack requirement (AT:P) - meaning exploitation depends on a specific deployment condition rather than being universally triggerable. Critically, all vulnerable-system impacts are None (VC:N/VI:N/VA:N) while the SUBSEQUENT-system impacts are High (SC:H/SI:H): this is a confused-deputy/authorization flaw (CWE-863) where the damage lands on the downstream AWS backend, not on ATS itself. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine but conditional priority - serious for the specific population running the origin_server_auth plugin against AWS, but not a broad drop-everything issue given the AT:P requirement and absence of any exploitation signal. Note the signals are internally consistent (no conflict between vector and description); the main uncertainty is the missing EPSS/KEV/POC data, whose absence is not itself evidence of low risk.

An attacker sends an ordinary client request through an Apache Traffic Server instance configured with the origin_server_auth plugin for AWS origin authentication, embedding attacker-chosen headers in the request. ATS then signs those attacker-controlled headers using its own AWS credentials and forwards the request to the AWS origin, letting the attacker exercise the proxy's privileges against the backend. No public exploit code is identified at time of analysis, and the attack only works where the AWS-signing plugin is active.