CVE-2026-102795

Friday, October 02, 2026

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Summary

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

Affected Software

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Traffic Server	`9.0.0 <= 9.2.14`	affected
Apache Software Foundation	Apache Traffic Server	`10.0.0 <= 10.1.3`	affected

Weaknesses

CWE-284: CWE-284 Improper Access Control

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: yes
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.