CVE-2026-111812 — Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

CVE-2026-111812

Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials PUBLISHED

Description (CNA)

Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Traffic Server	affected 8.0.0 through 8.1.11; affected 9.0.0 through 9.2.15; affected 10.0.0 through 10.1.4; affected 10.2.0

CWE

CWE-863

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.