A vulnerability in Apache Traffic Server’s experimental tsmemcache plugin allows an unauthenticated attacker to read, write, or delete entries in the shared proxy cache. The plugin exposes this functionality over the network without any authentication or authorization controls, enabling arbitrary manipulation of cached content. If exploited, an attacker could alter or remove cached data, potentially causing denial of service, cache poisoning, or unintended data disclosure.

Apache Traffic Server versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are affected.

The CVSS score of 9.4 indicates a high severity vulnerability. With no EPSS data and not listed in the CISA KEV catalog, the likelihood of exploitation is uncertain but remains a significant risk due to the completely unauthenticated nature of the access. The attack vector is network‑based: an attacker can send requests to the tsmemcache plugin interface from any remote system, performing cache operations without credentials.