CVE-2026-102795 in Apache Traffic Server: building a version inventory before you patch

Vulnerability overview

Apache Traffic Server is affected by CVE-2026-102795, an improper access control flaw that the Apache Software Foundation disclosed on 2 October 2026 as part of a batch of eight CVEs spanning three projects. The same advisory batch covered Apache OpenOffice and the Apache Directory LDAP API. Reporting on the batch places CVE-2026-102795 at the top of the severity table with a 9.3 CVSSv3 score, while the accompanying prose describes it as an improper access control issue rated 7.0 on CVSS 4.0. Both figures appear in the same secondary report, and NVD had not published an analysed record at the time of writing, so treat the precise score as unsettled rather than as an established fact.

What the flaw concerns

The published description states that a "SNI to Host header matching policy is not properly enforced". SNI, the Server Name Indication extension, travels in the TLS handshake and tells a listener which certificate and, by extension, which virtual service the client expects. The HTTP Host header carries a similar claim inside the request itself. Operators who run Traffic Server in front of multiple backends typically want those two values checked against each other so that a client cannot retrieve content through an unintended route. CVE-2026-102795 concerns a case where that enforcement does not hold as intended.
Apache has not published a step-by-step exploitation narrative in the material available so far, and no public proof-of-concept is confirmed. That makes the practical question narrower than it first appears: which of your properties relies on SNI and Host agreement for separation, and does that separation still hold after the upgrade?

Affected products and scope

The affected range is unusually clean to enumerate:

• Apache Traffic Server 9.0.0 through 9.2.14
• Apache Traffic Server 10.0.0 through 10.1.3 The fixed releases are 9.2.15 and 10.1.4. Administrators should note that a prior record, CVE-2026-41920, described the same access control weakness but listed an incorrect 9.x range and named 9.1.15 as the fix. Anyone who used that earlier record as the basis for a change ticket may have concluded they were already current. They were not.

Exposure context

A ZoomEye query for app="Apache Traffic Server" returned 311,469 matching assets on 3 October 2026. A separate query on vul.cve="CVE-2026-102795" returned 0, which is expected for a freshly published CVE that indexers have not yet correlated.
The product figure describes the size of the observable population. It does not mean that 311,469 systems are vulnerable, because it cannot distinguish a current build from an older one and cannot tell whether SNI and Host matching is part of any given deployment's design.

Remediation and validation

Upgrade to 9.2.15 or 10.1.4 and then confirm the change rather than assuming it. A useful check has three parts. First, verify the running build identifier through your normal configuration endpoint or package metadata. Second, if your deployment depends on SNI and Host agreement, reproduce the routing decision in a staging environment with both a matching and a deliberately mismatched pair. Third, keep the evidence attached to the change record, because the superseded CVE record makes "we already patched this" a plausible and incorrect conclusion for a reviewer to reach.

References

• SecurityOnline reporting on the Apache advisory batch, 3 October 2026
• Apache Traffic Server download and release information