CVE-2026-111812
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.
Risk Assessment
An attacker may use the proxy's credentials to sign their own AWS headers, potentially leading to unauthorized access to cloud resources. Risk applies to installations with the origin_server_auth plugin enabled.
Recommendation
Upgrade Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1. Consider disabling the origin_server_auth plugin until upgraded.
Other vulnerabilities in Apache Traffic Server
See all- CVE-2017-5659High
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
- CVE-2016-5396High
Apache Traffic Server versions 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
- CVE-2014-3525High
Unspecified vulnerability in Apache Traffic Server versions 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1. This vulnerability may be related to health checks, but its impact and attack vectors are unknown.
- CVE-2026-111815Critical
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.
- CVE-2026-111814Critical
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This affects versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.
- CVE-2026-111811Critical
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.
- CVE-2026-111809Critical
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding headers. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.
- CVE-2026-111816Critical
Apache Traffic Server forwards malformed 302 responses that should be rejected as parse errors because the Transfer-Encoding: chunked carve-out bypasses the rejection path. A response that two peers can read differently is stored and served, allowing cache poisoning and response-framing desync.
- CVE-2026-111813Critical
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. Affects versions 8.0.1–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.
- CVE-2026-102795Critical
Apache Traffic Server contains an improper access control vulnerability. This issue affects Apache Traffic Server from 9.0.0 through 9.2.14 and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15; all 9.2.x releases before 9.2.15 are affected.
Original NVD description (English source)
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS