CVE-2026-41920

CriticalCVSS 9.3

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Apache Traffic Server has an Improper Access Control vulnerability. This affects versions from 9.0.0 to 9.1.14 and from 10.0.0 to 10.1.3.

Risk Assessment

An unauthorized user may gain access to protected resources or functions, potentially leading to data leakage or system integrity compromise.

Recommendation

Upgrade to version 9.1.15 or 10.1.4, which include the fix.

Original NVD description (English source)

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.