CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
- Record
CVE-2026-102795- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-91766
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
- Record
EUVD-2026-91766- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r73v-c3ch-65gj
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache...
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
- Record
GHSA-r73v-c3ch-65gj- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
- Record
CVE-2026-102795- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-102795
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
- Record
DEBIAN-CVE-2026-102795- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVOESA-2026-4231
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.(CVE-2026-102795)
- Record
OESA-2026-4231- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4232
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.(CVE-2026-102795)
- Record
OESA-2026-4232- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4233
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.(CVE-2026-102795)
- Record
OESA-2026-4233- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-102795
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
- Record
UBUNTU-CVE-2026-102795- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserverDebian:12 |
All versions, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 9 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u19.2.5+ds-0+deb12u29.2.5+ds-0+deb12u39.2.5+ds-0+deb12u49.2.5+ds-1 |
None known |
trafficserveropenEuler:24.03-LTS-SP3 |
before 9.2.15-1.oe2403sp3 | 9.2.15-1.oe2403sp3 |
trafficserveropenEuler:24.03-LTS-SP4 |
before 9.2.15-1.oe2403sp4 | 9.2.15-1.oe2403sp4 |
trafficserveropenEuler:24.03-LTS-SP1 |
before 9.2.15-1.oe2403sp1 | 9.2.15-1.oe2403sp1 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
trafficserverUbuntu:24.04:LTS |
All versions, plus listed versions 9.2.1+ds-1build19.2.2+ds-19.2.3+ds-19.2.3+ds-1+deb12u19.2.3+ds-1+deb12u1build19.2.3+ds-1+deb12u1build39.2.3+ds-1+deb12u1build49.2.3+ds-1+deb12u1ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-102795 is a high vulnerability (CVSS 7.0) in Apache Software Foundation Traffic Server, published October 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in trafficserver 9.2.15-1.oe2403sp3.
References
lists.apache.org/thread.html/qcxzvcbbln68hd0j08pdnjdj4r991nhd
cve.org/CVERecord?id=CVE-2026-41920
nvd.nist.gov/vuln/detail/CVE-2026-102795
github.com/advisories/GHSA-r73v-c3ch-65gj
security-tracker.debian.org/tracker/CVE-2026-102795
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4231