AI analysis
Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contain an improper access control flaw (CWE-284). The issue is reachable over the network without authentication or user interaction, though some attack preconditions apply, and the published severity is high (CVSS 4.0 base score 7). Impact is scored against subsequent systems rather than the Traffic Server process itself, with high confidentiality and integrity impact and no availability impact indicated. Operators of Apache Traffic Server in those ranges are affected; this record corrects CVE-2026-41920, which understated the 9.x range and named the wrong fixed 9.x release. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade Apache Traffic Server to 9.2.15 or 10.1.4. Treat every 9.x release from 9.0.0 through 9.2.14 as vulnerable, including all 9.2.x builds before 9.2.15; do not rely on the narrower range in superseded CVE-2026-41920. After upgrading, confirm the running version and review access-control and proxy rules for unexpected exposure of backend systems.
Affected
| Apache Software Foundation Traffic Server | 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 |
Estimated exposure
moderatethousands to low tens of thousands of deployments — Apache Traffic Server is a specialized caching proxy and CDN edge product, not a mass-market web server, so affected deployments are far below general HTTP-server counts; public fingerprinting typically shows thousands of internet-visible…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.