PT-2026-104408

CVE-2026-102795

Published

2026-10-02

Updated

2026-10-16

Description by

CVSS 3.1

9.3

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3

Description An improper access control issue exists where SNI-to-Host access control is not enforced. Approximately 311,500 instances are identified globally.

Recommendations Upgrade Apache Traffic Server versions 9.0.0 through 9.2.14 to version 9.2.15. Upgrade Apache Traffic Server versions 10.0.0 through 10.1.3 to version 10.1.4.

Exploitability

Fix

Impacts

Researchers

Apache Community

Jd Marsters

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2026-102795