{"id":"CVE-2026-111811","kind":"vulnerability","aliases":["CVE-2026-111811"],"related":[],"title":"Apache Traffic Server: experimental tsmemcache plugin lets anyone read and wipe cache","description":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","summary":"The experimental tsmemcache plugin in Apache Traffic Server exposes the shared proxy cache over the network without authentication. An attacker can read, overwrite, or delete cached content.","severity":"critical","cvss":9.4,"epss":0.00259,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-traffic-server","cdn","reverse-proxy","runtime","self-hosted"],"not_affected_if":["default-config","tsmemcache-not-loaded"],"how_to_check":"Check whether the tsmemcache plugin is loaded in plugin.config or the plugin list of the running Traffic Server, and check the installed version with traffic_server -V.","fix":"Upgrade to 9.2.16, 10.1.5, or 10.2.1 depending on your release line; or disable the tsmemcache plugin.","status":"open","published_at":"2026-10-21T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:53+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:32:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 9.2.16, 10.1.5, or 10.2.1 depending on your release line; or disable the tsmemcache plugin.","reach":"network","title":"Apache Traffic Server: experimental tsmemcache plugin lets anyone read and wipe cache","impact":"medium","summary":"The experimental tsmemcache plugin in Apache Traffic Server exposes the shared proxy cache over the network without authentication. An attacker can read, overwrite, or delete cached content.","category":"runtime","who_cares":["apache-traffic-server","cdn","reverse-proxy","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Anyone on the network can read, change, or delete shared proxy cache entries.","analyst_note":"Confirm the exact network exposure of the tsmemcache listener and whether the affected 8.x line still receives fixes; check NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-111811.","how_to_check":"Check whether the tsmemcache plugin is loaded in plugin.config or the plugin list of the running Traffic Server, and check the installed version with traffic_server -V.","needs_analyst":true,"not_affected_if":["default-config","tsmemcache-not-loaded"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3007,"output_tokens":482,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111811':15A,18A '-2026':14A,17A '10.0.0':92C '10.1.4':94C '10.1.5':104C '10.2.0':95C '10.2.1':106C '8.0.0':84C '8.1.11':86C '9.0.0':88C '9.2.15':90C '9.2.16':103C 'affect':79C 'allow':65C 'anyon':8A 'apach':1A,20B,36B,58C,80C 'apache-traffic-serv':19B 'attack':50B 'authent':48B 'cach':12A,43B,56B,76C 'cdn':23B 'content':57B 'cve':13A,16A 'delet':55B,71C 'experiment':4A,32B,62C 'expos':39B 'fix':108C 'host':30B 'issu':78C,110C 'let':7A 'network':46B,67C 'overwrit':53B 'plugin':6A,34B,64C 'proxi':26B,42B,75C 'read':9A,52B,68C 'recommend':98C 'revers':25B 'reverse-proxi':24B 'runtim':27B 'self':29B 'self-host':28B 'server':3A,22B,38B,60C,82C 'share':41B,74C 'traffic':2A,21B,37B,59C,81C 'tsmemcach':5A,33B,63C 'unauthent':66C 'upgrad':100C 'user':96C 'version':102C 'wipe':11A 'without':47B 'write':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111811","severity":null,"published_at":"2026-10-21T20:17:22+00:00","modified_at":"2026-10-23T12:18:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111811","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111811","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}