CVE-2026-111812 is a vulnerability in Apache Traffic Server
Published on October 21, 2026
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Vulnerability Analysis
CVE-2026-111812 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-111812 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-111812
Want to know whenever a new CVE is published for Apache Traffic Server? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Traffic Server:- Version 8.0.0, <= 8.1.11 is affected.
- Version 9.0.0, <= 9.2.15 is affected.
- Version 10.0.0, <= 10.1.4 is affected.
- Version 10.2.0 is affected.