Vulnerability details

CVE-2026-111811

Apache Software Foundation Apache Traffic Server

Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

CVSS 4.0

9.4Critical

Official description

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

CVSS scores

Score	Version	Source	Vector
9.4Critical	4.0	CVEProject cvelistV5 (CNA) (apache)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H`
9.0Critical	3.1	CVEProject cvelistV5 (CNA) (apache)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Apache Software Foundation	Apache Traffic Server	10.2.0	CVEProject cvelistV5 (CNA)
Apache Software Foundation	Apache Traffic Server	10.0.0 ≤ v ≤ 10.1.4	CVEProject cvelistV5 (CNA)
Apache Software Foundation	Apache Traffic Server	8.0.0 ≤ v ≤ 8.1.11	CVEProject cvelistV5 (CNA)
Apache Software Foundation	Apache Traffic Server	9.0.0 ≤ v ≤ 9.2.15	CVEProject cvelistV5 (CNA)

References and advisories

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-21
Last updated: 2026-10-23
State: Published
Assigner (CNA): apache
Kolun priority: 22 · Low

Exploit prediction (EPSS)

0.35%

Probability of exploitation in 30 days

29.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-306
Missing Authentication for Critical Function