Unintended Proxy or Intermediary in Apache Traffic Server - CVE-2026-111812
Published: October 23, 2026
Vulnerability identifier: #VU157333
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111812
CWE-ID: CWE-441
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain signatures for attacker-chosen AWS request headers under the proxy's IAM credentials, potentially enabling unauthorized access to or modification of AWS resources.
The vulnerability exists due to a confused-deputy weakness in the Apache Traffic Server origin_server_auth plugin when signing client-controlled AWS request headers. A remote attacker can submit chosen AWS headers for signing under the proxy's credentials to perform requests with the proxy's IAM authority, potentially accessing or modifying resources without authorization.
Affected software
Apache Traffic Server
How to mitigate CVE-2026-111812
Install security update from vendor's website.
Apache Traffic Server - addressed in versions 9.2.16, 10.1.5, 10.2.1