Live › vulnerability › CVE-2026-111812
Go to dashboardThe origin_server_auth plugin in Apache Traffic Server lets a client choose which AWS request headers get signed. An attacker can make the proxy sign requests with its own AWS credentials, so the attacker can reach resources those credentials allow.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.09.2.16, 10.1.5, or 10.2.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111812")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.