---
id: "CVE-2026-111811"
kind: "vulnerability"
aliases: ["CVE-2026-111811"]
title: "Apache Traffic Server: experimental tsmemcache plugin lets anyone read and wipe cache"
severity: "critical"
cvss: 9.4
epss: 0.00259
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-traffic-server", "cdn", "reverse-proxy", "runtime", "self-hosted"]
not_affected_if: ["default-config", "tsmemcache-not-loaded"]
published_at: "2026-10-21T20:17:22+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111811", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111811", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache Traffic Server: experimental tsmemcache plugin lets anyone read and wipe cache

The experimental tsmemcache plugin in Apache Traffic Server exposes the shared proxy cache over the network without authentication. An attacker can read, overwrite, or delete cached content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the tsmemcache plugin is loaded in plugin.config or the plugin list of the running Traffic Server, and check the installed version with traffic_server -V.

## Fix

Upgrade to 9.2.16, 10.1.5, or 10.2.1 depending on your release line; or disable the tsmemcache plugin.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111811
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111811

## From the sources

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_