Which versions of Apache Traffic Server are affected by EUVD-2026-50167?

Apache Traffic Server 9.0.0-9.1.14 and 10.0.0-10.1.3 contain an unauthenticated access control bypass that allows attackers to circumvent authorization enforcement on backend systems the proxy…

How to fix or mitigate EUVD-2026-50167?

Within 24 hours, identify all deployments of Apache Traffic Server versions 9.0.0-9.1.14 and 10.0.0-10.1.3 across your infrastructure and enable detailed request logging to establish baseline traffic patterns. Within 7 days, implement network-level access controls restricting direct access to Traffic Server to authorized clients only, deploy Web Application Firewall rules to enforce independent authorization validation, and verify that backend systems have their own authentication and authorization mechanisms functioning independently of proxy-level controls. Within 30 days, establish an upgrade plan to traffic vendor-patched versions of Traffic Server as they become available, or execute migration to alternative reverse proxy solutions (nginx, HAProxy) if vendor patches are delayed beyond your risk tolerance.

Apache Traffic Server EUVD-2026-50167

Q: What is the CVSS score of EUVD-2026-50167?

EUVD-2026-50167 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-41920 HIGH

Improper Access Control (CWE-284)

2026-07-29 apache

GHSA-cjg7-6cv5-8fpp

Authentication Bypass Apache Apache Traffic Server Apache Software Foundation

7.0

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but the attack requirement raises complexity (AC:H); the bypass affects fronted backends, so scope changes (S:C) with high C/I and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 08:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 08:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 08:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 08:22 NVD

9.3 (MEDIUM) 7.0 (HIGH)

Analysis Generated

Jul 29, 2026 - 08:18 vuln.today

CVE Published

Jul 29, 2026 - 07:18 cve.org

MEDIUM 9.3

DescriptionCVE.org

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

AnalysisAI

Access control bypass in Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3 lets remote unauthenticated attackers subvert authorization enforcement at the proxy, tagged by Apache as an authentication bypass (CWE-284). Because Traffic Server acts as a caching/reverse proxy, the flaw's impact lands on backend systems it fronts rather than on the proxy process itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High).

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance HTTP caching proxy and reverse-proxy server used to accelerate and mediate traffic in front of origin/backend infrastructure, notably in large CDN and edge deployments. The root cause is CWE-284 (Improper Access Control): the server fails to correctly enforce an authorization or access-control decision, which the 'Authentication Bypass' tag frames as an auth-enforcement gap. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server confirms the affected component is the ATS application across all edition qualifiers. The CVSS 4.0 vector's subsequent-system impacts (SC:H/SI:H) with no vulnerable-system impact (VC:N/VI:N/VA:N) are characteristic of a proxy defect: the proxy itself is not compromised, but the access-control failure exposes or alters data on the systems it protects.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.1.15 (for the 9.x line) or 10.1.4 (for the 10.x line), as specified in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Upgrading within the same major line is the primary and recommended fix and should be low-friction. Until patching is possible, reduce exposure by restricting network reach to the ATS listener (place it behind an authenticated edge or firewall the management/proxy ports to trusted sources) and, where feasible, enforce access-control decisions at the origin/backend as well as the proxy so a proxy-side bypass does not directly expose protected resources; the trade-off is added latency and configuration overhead, and backend-side enforcement may not cover all routes ATS mediates. Because the exact triggering condition (CVSS AT:P) is not detailed in the supplied data, consult the linked advisory to identify any feature or configuration that can be temporarily disabled as a targeted workaround.