Which versions of Apache Traffic Server are affected by EUVD-2026-50218?

Apache Traffic Server's certificate generation feature can be manipulated by remote attackers to issue TLS certificates for fraudulent identities, compromising the encryption trust that protects…

How to fix or mitigate EUVD-2026-50218?

Within 24 hours, inventory all systems running Apache Traffic Server and identify which versions are deployed; prioritize production proxies handling sensitive traffic. Within 7 days, implement compensating controls: restrict SNI-based certificate generation to an explicit whitelist of permitted domains, enable comprehensive audit logging of all certificate issuance events, and deploy network-layer monitoring to detect unusual certificate requests. Establish a 30-day migration plan to upgrade to a patched version once the vendor releases it; meanwhile, evaluate rerouting non-critical traffic away from vulnerable instances or enforcing client certificate pinning as defense-in-depth.

Apache Traffic Server EUVD-2026-50218

Q: What is the CVSS score of EUVD-2026-50218?

EUVD-2026-50218 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-58162 HIGH

Improper Certificate Validation (CWE-295)

2026-07-29 apache

GHSA-2w9p-8x38-7x8f

Apache Information Disclosure Apache Traffic Server Apache Software Foundation

8.4

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H reflects the required non-default certifier plugin; impact is integrity/availability high with low confidentiality, matching a cert-generation flaw.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:49 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 29, 2026 - 10:49 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

10.0 (MEDIUM) 8.4 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:59 vuln.today

CVE Published

Jul 29, 2026 - 08:36 cve.org

MEDIUM 10.0

DescriptionCVE.org

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents of dynamically minted TLS certificates by controlling the client SNI value, affecting ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. Because the plugin trusts attacker-supplied SNI to drive certificate creation (CWE-295), an unauthenticated remote party can influence which identities the proxy vouches for, undermining TLS trust. No public exploit identified at time of analysis, though the vendor-scored CVSS 4.0 base is 8.4 (high).

Technical ContextAI

Apache Traffic Server is a high-performance forward/reverse HTTP caching proxy. The optional 'certifier' plugin performs on-the-fly TLS certificate generation and signing so ATS can terminate or bridge TLS for many hostnames without pre-provisioning each certificate. It keys certificate generation on the Server Name Indication (SNI) field presented by the connecting client during the TLS handshake. The flaw is a CWE-295 Improper Certificate Validation issue: the client-supplied SNI is attacker-controlled input, yet the plugin uses it directly as the basis for the certificate it generates, so an attacker chooses the subject/identity material that gets signed. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server confirms the affected component is the ATS product itself, specifically deployments that load the certifier plugin.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which fix the issue per the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d); note the 8.x line has no listed fixed release, so 8.0.0-8.1.9 users should migrate to a fixed 9.2.x or 10.1.x build. If immediate patching is not possible, the most effective compensating control is to disable or unload the certifier plugin from remap/plugin configuration, since the vulnerability only manifests when that plugin generates certificates from client SNI; the trade-off is loss of dynamic on-the-fly certificate generation, requiring pre-provisioned certificates instead. Where the plugin must stay enabled, restrict which clients and SNI values can reach the TLS listener via network ACLs or an upstream filter to limit attacker control over SNI, accepting that this narrows legitimate client reach.