Authentication Bypass in Apache Traffic Server's Proxy Cache Plugin
CVE-2026-111811

9.4CRITICAL

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111811?

Apache Traffic Server's experimental tsmemcache plugin exposes a serious vulnerability that enables unauthenticated users to read, write, and delete entries from the shared proxy cache. This could lead to unauthorized access to critical cached information, impacting confidentiality and integrity. To mitigate this risk, users are strongly encouraged to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which provide necessary security fixes.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 8.1.11

Apache Traffic Server 9.0.0 <= 9.2.15

Apache Traffic Server 10.0.0 <= 10.1.4

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb1...
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Community
.