[ CVE-2026-102795 · Published 2 Oct 2026 ]

Vulnerability in Apache Software Foundation Apache Traffic Server

CVSS 9.3 EPSS <1%1 agency advisoryNo fix listed yet

[ Why it matters ]Priority signals

Critical severity: CVSS 9.3

[ Description ]Official description

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund4 Oct 2026WID-SEC-2026-3735

Apache Traffic Server: Vulnerability allows bypassing security measures Translated from German
CVE-2026-102795

[ Why it matters ]Priority signals

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Apache Traffic Server: Vulnerability allows bypassing security measures Translated from German

[ References ]References