CVE-2026-58162

Received Received - Intake

Improper Certificate Generation in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Apache Software Foundation

Description

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-58162

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.14 (inc)
apache	traffic_server	From 10.0.0 (inc) to 10.1.3 (inc)
apache	traffic_server	9.2.15
apache	traffic_server	10.1.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

The Apache Traffic Server certifier plugin creates certificates using client SNI values controlled by an attacker. This allows malicious actors to generate certificates for arbitrary domains, potentially leading to man-in-the-middle attacks or unauthorized access.

Impact Analysis

An attacker could intercept or manipulate traffic by impersonating legitimate services. This may result in data breaches, unauthorized access to sensitive information, or disruption of services relying on Apache Traffic Server.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-58162. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70