CVE-2026-41920

CVSS 4.0: 7.0 high
EPSS: <1%p24
Published: Jul 29, 2026 · Jul 29, 2026
Modified: Oct 23, 2026

Analyze CVE-2026-41920 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

Vendors: apache

Products: traffic server

Weakness: CWE-284

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

1 story

CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920)

Apache Traffic Server improperly enforces SNI-to-Host matching; moderate CVE-2026-102795 is fixed in 9.2.15 and 10.1.4.

oss-securityOct 2, 19:20 UTC · 28d agoVulnerabilityCVE-2026-102795 CVE-2026-419202