CVE-2026-102795
published 2026-10-02CVE-2026-102795: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through…
PriorityP260critical9.3CVSS 3.1
AVNACLPRNUINSCCLIHAN
EPSS
0.28%
19.0th percentile
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_traffic_server | 10.0.0 – 10.1.3 | — |
| apache_software_foundation | apache_traffic_server | 9.0.0 – 9.2.14 | — |
CVSS provenance
nvdv3.19.3CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
nvdv4.07.0HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Access Control vulnerability in Apache Traffic Server.
ghsa_unreviewed·2026-10-02·CVSS 9.3
CVE-2026-102795 [CRITICAL] CWE-284 Improper Access Control vulnerability in Apache Traffic Server.
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
VulDB
Apache Traffic Server up to 9.2.14/10.1.3 access control (EUVD-2026-91766)
vuldb·2026-10-02·CVSS 9.3
CVE-2026-102795 [CRITICAL] Apache Traffic Server up to 9.2.14/10.1.3 access control (EUVD-2026-91766)
A vulnerability described as critical has been identified in Apache Traffic Server up to 9.2.14/10.1.3. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper access controls.
The identification of this vulnerability is CVE-2026-102795. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
Red Hat
trafficserver: trafficserver: Security restriction bypass via improper access control
vendor_redhat·2026-10-02·CVSS 9.3
CVE-2026-102795 [CRITICAL] CWE-1288 trafficserver: trafficserver: Security restriction bypass via improper access control
trafficserver: trafficserver: Security restriction bypass via improper access control
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
A flaw was found in Apache Traffic Server. Due to improper access controls, an unauthenticated remote attacker can bypass intended access restrictions. This vulnerability may allow an attacker to modify sensitive data or gain unauthorized access to protected resources.
Statement
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [epel-all]
bugzilla·2026-10-06·CVSS 9.3
CVE-2026-102795 [CRITICAL] CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [epel-all]
CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
Discussion:
*** This
Bugzilla
CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [fedora-all]
bugzilla·2026-10-06·CVSS 9.3
CVE-2026-102795 [CRITICAL] CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [fedora-all]
CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
Discussion:
*** Thi
Bugzilla
CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control
bugzilla·2026-10-02·CVSS 9.3
CVE-2026-102795 [CRITICAL] CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control
CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
2026-10-02
Published