CVE-2026-41920
published 2026-07-29CVE-2026-41920: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through…
PriorityP357critical9.3CVSS 3.1
AVNACLPRNUINSCCLIHAN
EPSS
0.31%
24.0th percentile
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | >= 10.0.0 < 10.1.4 | 10.1.4 |
| apache | traffic_server | >= 9.0.0 < 9.2.15 | 9.2.15 |
| apache_software_foundation | apache_traffic_server | 10.0.0 – 10.1.3 | — |
| apache_software_foundation | apache_traffic_server | 9.0.0 – 9.1.14 | — |
CVSS provenance
nvdv3.19.3CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
nvdv4.07.0HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced
bugzilla·2026-07-29·CVSS 9.3
CVE-2026-41920 [CRITICAL] CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced
CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
Bugzilla
CVE-2026-41920 trafficserver: SNI to Host header matching policy is not properly enforced [epel-all]
bugzilla·2026-07-29·CVSS 9.3
CVE-2026-41920 [CRITICAL] CVE-2026-41920 trafficserver: SNI to Host header matching policy is not properly enforced [epel-all]
CVE-2026-41920 trafficserver: SNI to Host header matching policy is not properly enforced [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
Bugzilla
CVE-2026-41920 trafficserver: SNI to Host header matching policy is not properly enforced [fedora-all]
bugzilla·2026-07-29·CVSS 9.3
CVE-2026-41920 [CRITICAL] CVE-2026-41920 trafficserver: SNI to Host header matching policy is not properly enforced [fedora-all]
CVE-2026-41920 trafficserver: SNI to Host header matching policy is not properly enforced [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
2026-07-29
Published