CVE-2026-102795CWE-284broken-access-control

CVE-2026-102795

Critical · published October 2, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-10-02T22:16Z
References (2)
https://lists.apache.org/thread.html/qcxzvcbbln68hd0j08pdnjdj4r991nhd · [email protected]https://www.cve.org/CVERecord?id=CVE-2026-41920 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 17:40Z
    Apache Traffic Server: SNI to Host header matching policy is not properly enforced
    cvelistv5