Apache Traffic Server EUVD-2026-91766

The CVSS 4.0 vector sets AT:P, meaning exploitation depends on a specific attack requirement/condition that is not under the attacker's direct control (e.g., a particular request state, timing, or proxy routing configuration), so it is not guaranteed on every request; however, the public description does not name the exact Traffic Server feature, directive, or deployment mode that must be present, so the precise prerequisite cannot be confirmed from available data and should be verified against the Apache advisory thread. Exploitation is remote and requires no authentication (PR:N) and no user interaction (UI:N), but the practical blast radius is limited to backend/subsequent systems the proxy fronts (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Affected deployments are limited to Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3; instances on 9.2.15/10.1.4 or later are not exploitable.

This is a genuine but conditional risk rather than an urgent emergency. The Apache-assigned CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes an unauthenticated, network-reachable improper access control flaw, but the AT:P metric signals that a specific attack requirement/condition outside the attacker's direct control must be met, which tempers real-world exploitability. Notably, the vector reports NO impact to the vulnerable system itself (VC:N/VI:N/VA:N) and instead places the entire impact on subsequent/downstream systems (SC:H/SI:H) - consistent with Traffic Server acting as a reverse/forward proxy where an access-control bypass exposes or tampers with protected backend resources rather than the proxy host. No EPSS score, CISA KEV listing, or POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.0 base score reflects potential downstream impact, not confirmed widespread attack activity. The 'Authentication Bypass' tag aligns directionally with CWE-284 (Improper Access Control) but the terse description does not confirm a classic credential-level auth bypass - treat that label as indicative, not authoritative. Net: prioritize patching as a meaningful proxy-tier access-control issue, but it is not a drop-everything, mass-exploited threat on current signals.

An attacker sends crafted requests to an internet-facing Apache Traffic Server proxy and, under the specific conditions implied by AT:P, bypasses access-control enforcement so the proxy forwards or exposes protected resources on a backend/origin system it fronts. Because impact falls on subsequent systems (SC:H/SI:H), the result is unauthorized read and/or manipulation of downstream content or services rather than compromise of the proxy itself. No public proof-of-concept is identified at time of analysis.