CVE-2026-102795

Description

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

CVSS Metrics

• v4.0•HIGH•Score: 7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
• v4.0•HIGH•Score: 7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•CRITICAL•Score: 9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Techniques & Countermeasures

• CWE-284•Improper Access Control

  The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected Systems

• apache software foundation•apache traffic server

  ≥ 9.0.0, ≤ 9.2.14 | ≥ 10.0.0, ≤ 10.1.3

References (2)

• https://lists.apache.org/thread.html/qcxzvcbbln68hd0j08pdnjdj4r991nhd
• https://www.cve.org/CVERecord?id=CVE-2026-41920