CVE-2026-102795

validated

GHSA-r73v-c3ch-65gj ↗EUVD-2026-91766 ↗

check availablenot proven exploitable

cve.orgpublic pockev

Apache Software Foundation Apache Traffic Server >= 9.0.0, <= 9.2.14; >= 10.0.0, <= 10.1.3

CWE-284 Improper Access Control

ETK-2026-366, permanent identifier

cvss7.0cna vendorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

+2h13mTTV

1h 04mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+2h13magent stopped

+1h

+2h

description

Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are affected by an improper access-control flaw. The advisory indicates that access controls can be bypassed or applied incorrectly; it does not specify the resulting attacker capability or required preconditions.

mitigation

Upgrade Apache Traffic Server 9.x to 9.2.15 or later, or 10.x to 10.1.4 or later. Prioritize systems exposed to untrusted clients until the upgrade is complete.

check

available

exploit

automation

deterministic

auth required

EPSS

0.28%19th percentile

agent run time

1h 04m

cve.org record, t = 0

2026-10-02 17:40Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-02 17:40Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-102795

this entry in the feed

GET /api/v1/feed/CVE-2026-102795

{
  "etk_id": "ETK-2026-366",
  "cve_id": "CVE-2026-102795",
  "display_id": "CVE-2026-102795",
  "ghsa_id": "GHSA-r73v-c3ch-65gj",
  "euvd_id": "EUVD-2026-91766",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper access control in Apache Traffic Server",
  "summary": "Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are affected by an improper access-control flaw. The advisory indicates that access controls can be bypassed or applied incorrectly; it does not specify the resulting attacker capability or required preconditions.",
  "mitigation": "Upgrade Apache Traffic Server 9.x to 9.2.15 or later, or 10.x to 10.1.4 or later. Prioritize systems exposed to untrusted clients until the upgrade is complete.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Traffic Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.0.0, <= 9.2.14",
        ">= 10.0.0, <= 10.1.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Traffic Server",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
  "epss_score": 0.0028,
  "epss_percentile": 0.196,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 63.54181893333333,
  "t0_at": "2026-10-02T17:40:50.648000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-02T19:54:19.489071+00:00",
      "days": 0.09269491980324074,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T17:40:50.648000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-02T17:40:50.648000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T17:40:50.648000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102795"
    }
  }
}

published 2026-10-02 18:50Z
last change 2026-10-21 16:41Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.