CVE-2026-58159

Analyzed Analyzed - Analysis Complete

IP Access Control Bypass in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58159

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Apache Traffic Server has a vulnerability where IP access controls can be bypassed on UDS listeners or through ACL matching errors. This allows unauthorized access to restricted resources.

Detection Guidance

Detecting this vulnerability requires checking Apache Traffic Server versions and configurations. First, verify the installed version using commands like 'traffic_server -v' or 'rpm -qa | grep trafficserver' on Linux. If the version falls within affected ranges (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), the system is vulnerable. Inspect UDS listener configurations and ACL rules for misconfigurations that could allow IP access bypass.

Impact Analysis

An attacker could exploit this to bypass security controls and access restricted systems or data. This may lead to unauthorized access, data breaches, or further network compromise depending on the server's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for GDPR (data protection) and HIPAA (health information security). Organizations may face penalties or legal consequences if exploited.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 or later to address the IP access control bypass issue.

Hi! I’m here to help you understand CVE-2026-58159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70