DEV Community

kozhevniko
kozhevniko

Posted on

Detection and verification for CVE-2026-102795 in Apache Traffic Server

#vulnerability #apachetrafficserver #accesscontrol

Detection and verification for CVE-2026-102795 in Apache Traffic Server

Overview

CVE-2026-102795 is an improper access control flaw in Apache Traffic Server, published 2 October 2026. Apache Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are affected. Fixed releases are 9.2.15 and 10.1.4. The advisory frames the issue as a SNI to Host header matching policy that does not behave as intended.

What defenders can actually verify

This is not a vulnerability that produces a distinctive log line, so detection starts with configuration and version truth rather than signature hunting.
Version truth. Enumerate every Traffic Server instance, including instances behind load balancers and instances in disaster-recovery sites that rarely carry traffic. Record the build string, not the package name.
Configuration truth. Identify which instances terminate TLS and route by hostname. For each, list the virtual hosts that are expected to serve content. An entry that nobody can justify is worth investigating.
Behaviour truth. In staging, issue two requests: one where the SNI and Host values match, and one where they deliberately do not. If the second request is served rather than refused, the deployment is relying on behaviour the fix is meant to change.

A note on absence of evidence

No exploitation in the wild has been reported for CVE-2026-102795, and there is no confirmed public proof of concept. The absence of exploitation reports is not evidence that exposure is theoretical, but neither does it justify describing the flaw as actively attacked. Both overstatement and dismissal are failures of the same kind: they substitute a conclusion for the available facts.

Affected products and scope

Branch Affected Fixed
9.x 9.0.0 - 9.2.14 9.2.15
10.x 10.0.0 - 10.1.4 and earlier 10.1.4

The earlier CVE-2026-41920 record gave the wrong 9.x range and pointed at 9.1.15; CVE-2026-102795 supersedes it.

Exposure context

ZoomEye measured 311,469 assets matching app="Apache Traffic Server" on 3 October 2026, with 0 for vul.cve="CVE-2026-102795". Use the first figure to size the inventory effort and the second to remind yourself that index coverage lags disclosure.

Remediation and validation steps

  1. Upgrade to 9.2.15 or 10.1.4.
  2. Confirm the running build identifier on every instance.
  3. Re-run the staged matching and mismatching request pair and store the results.
  4. Remove catch-all virtual hosts so an unexpected name fails closed.

References

  • SecurityOnline reporting on the Apache advisory batch, 3 October 2026
  • Apache Traffic Server download and release information

Top comments (0)