Eight CVEs, three Apache projects: placing CVE-2026-102795 in the October 2026 advisory batch

Overview

The Apache Software Foundation published eight CVEs on 2 October 2026 across three projects. The batch covered Apache OpenOffice, the Apache Directory LDAP API, and Apache Traffic Server. CVE-2026-102795 is the Traffic Server entry: an improper access control flaw affecting versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3, fixed in 9.2.15 and 10.1.4.

Reading a batch correctly

A batch summary is a useful map but a poor substitute for the individual advisory. In this batch the prose described CVE-2026-102795 as an improper access control issue rated 7.0 under CVSS 4.0, while the accompanying severity table listed 9.3 under CVSSv3. Two schemes, two readings, one identifier.
The other entries in the batch differ substantially in character. The Apache OpenOffice flaw is an untrusted search path weakness in the Java integration, where opening a crafted document can lead to code execution and the fix was still a release candidate at the time of writing. The LDAP API entries include a deserialization issue that a malicious server could use against a client, and several denial-of-service conditions. Lumping these together under a single "Apache" heading would obscure the fact that they sit in different products with different exposure models.

What the Traffic Server entry actually says

Apache describes the enforcement of a "SNI to Host header matching policy" as not working properly. There is no published request-level exploitation sequence and no confirmed public proof of concept.

Affected products and scope

• Apache Traffic Server 9.0.0 through 9.2.14, fixed in 9.2.15
• Apache Traffic Server 10.0.0 through 10.1.3, fixed in 10.1.4 The Traffic Server entry supersedes CVE-2026-41920, which described the same weakness with an incorrect 9.x range and a misleading fix version.

Exposure context

ZoomEye matched 311,469 assets for app="Apache Traffic Server" on 3 October 2026 and 0 for vul.cve="CVE-2026-102795". The product figure covers all observable instances of the software, not only those inside the affected version window, and it says nothing about whether hostname routing is part of a given deployment.

Remediation

Upgrade to 9.2.15 or 10.1.4. When triaging the batch as a whole, keep the change tickets separate, because the remediation for an OpenOffice document-handling flaw and the remediation for a proxy access control flaw have nothing in common beyond the vendor.

References

• SecurityOnline reporting on the Apache advisory batch, 3 October 2026
• Apache Traffic Server download and release information