Missing Authentication for Critical Function in Apache Traffic Server - CVE-2026-111811
Published: October 23, 2026
Vulnerability identifier: #VU157332
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111811
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read, modify, or delete shared proxy-cache contents, compromising confidentiality, integrity, and availability.
The vulnerability exists due to missing authentication in the Apache Traffic Server experimental tsmemcache plugin when exposing the shared proxy cache over the network. A remote attacker can issue cache read, write, and deletion operations through the plugin's network interface to disclose cached data, alter cache contents, or disrupt cache availability.
Affected software
Apache Traffic Server
How to mitigate CVE-2026-111811
Install security update from vendor's website.
Apache Traffic Server - addressed in versions 9.2.16, 10.1.5, 10.2.1