CVE-2026-58156

Analyzed Analyzed - Analysis Complete

Port-Based Access Control Bypass in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-58156

EUVD

EUVD-2026-50185

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing attackers to bypass port-based access controls. This means security rules that restrict access based on specific ports may be ineffective.

Detection Guidance

This vulnerability involves port mis-parsing in URLs and userinfo, which could allow access-control bypass. Detection may require reviewing Apache Traffic Server logs for unusual port handling or access patterns. Check if your version is within affected ranges (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3). If so, inspect configurations for port-based access rules that might be bypassed.

Impact Analysis

If you use Apache Traffic Server versions 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, or 10.0.0 to 10.1.3, attackers could bypass security restrictions by manipulating URLs or userinfo fields. This may lead to unauthorized access to protected resources.

Compliance Impact

The vulnerability allows port-based access-control bypass, which could lead to unauthorized access to sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized data exposure or breaches.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain fixes for this issue.

Hi! I’m here to help you understand CVE-2026-58156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70