Apache Traffic Server’s origin_server_auth plugin allows a client to supply arbitrary AWS headers that the proxy will pick up and sign with its own IAM credentials. This permits a malicious user to have the proxy generate authenticated requests to any AWS service the proxy’s credentials allow, potentially enabling data exfiltration or destructive actions on that user’s behalf.

Apache Traffic Server versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4 and 10.2.0 are affected.

The CVSS score of 7 indicates a medium‑to‑high severity flaw. EPSS score is < 1% and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. The likely attack vector is a remote HTTP client that can reach the proxy, which could lead to unauthorized AWS API calls to services the proxy’s IAM role permits. The impact scales with the scope of the IAM permissions granted to the proxy, potentially allowing significant damage.