{"id":"CVE-2026-111812","kind":"vulnerability","aliases":["CVE-2026-111812"],"related":[],"title":"Apache Traffic Server: clients can get proxy's AWS credentials to sign requests","description":"Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","summary":"The origin_server_auth plugin in Apache Traffic Server lets a client choose which AWS request headers get signed. An attacker can make the proxy sign requests with its own AWS credentials, so the attacker can reach resources those credentials allow.","severity":"critical","cvss":10.0,"epss":0.00262,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-traffic-server","aws","runtime","self-hosted"],"not_affected_if":["origin_server_auth-not-loaded","version-outside-affected-ranges"],"how_to_check":"Check the Traffic Server version (traffic_server -V) and whether origin_server_auth is loaded in plugin.config.\nAffected: 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0.","fix":"Upgrade to 9.2.16, 10.1.5, or 10.2.1.\nIf upgrading is not possible, unknown whether disabling origin_server_auth is a sufficient workaround.","status":"open","published_at":"2026-10-21T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:53+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:32:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 9.2.16, 10.1.5, or 10.2.1.\nIf upgrading is not possible, unknown whether disabling origin_server_auth is a sufficient workaround.","reach":"network","title":"Apache Traffic Server: clients can get proxy's AWS credentials to sign requests","impact":"high","summary":"The origin_server_auth plugin in Apache Traffic Server lets a client choose which AWS request headers get signed. An attacker can make the proxy sign requests with its own AWS credentials, so the attacker can reach resources those credentials allow.","category":"runtime","who_cares":["apache-traffic-server","aws","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker uses proxy's AWS credentials to access cloud resources","analyst_note":"Confirm from the NVD or vendor advisory whether a client needs any credentials or a specific route config to trigger it, and whether a workaround exists besides upgrading.","how_to_check":"Check the Traffic Server version (traffic_server -V) and whether origin_server_auth is loaded in plugin.config.\nAffected: 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0.","needs_analyst":true,"not_affected_if":["origin_server_auth-not-loaded","version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000568,"input_tokens":3002,"output_tokens":536,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111812':16A,19A '-2026':15A,18A '10.0.0':111C '10.1.4':113C '10.1.5':123C '10.2.0':114C '10.2.1':125C '8.0.0':103C '8.1.11':105C '9.0.0':107C '9.2.15':109C '9.2.16':122C 'affect':98C 'allow':69B 'apach':1A,21B,35B,70C,99C 'apache-traffic-serv':20B 'attack':49B,63B,85C 'attacker-chosen':84C 'auth':32B,76C 'aw':9A,24B,43B,59B,87C 'choos':41B 'chosen':86C 'client':4A,40B,80C 'credenti':10A,60B,68B,95C 'cve':14A,17A 'fix':127C 'forc':81C 'get':6A,46B 'header':45B,89C 'host':28B 'issu':97C,129C 'let':38B,78C 'make':51B 'origin':30B,74C 'plugin':33B,77C 'proxi':7A,53B,92C 'reach':65B 'recommend':117C 'request':13A,44B,55B,88C 'resourc':66B 'runtim':25B 'self':27B 'self-host':26B 'server':3A,23B,31B,37B,72C,75C,101C 'sign':12A,47B,54B,82C 'traffic':2A,22B,36B,71C,100C 'upgrad':119C 'user':115C 'version':121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111812","severity":null,"published_at":"2026-10-21T20:17:23+00:00","modified_at":"2026-10-23T12:18:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111812","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111812","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}