Apache Traffic Server implements IP access controls on Unix Domain Socket listeners and with ACL matching. A flaw allows a malicious user to circumvent these controls, enabling unauthorized traffic to be forwarded. The weakness aligns with CWE‑863, indicating a flaw in access control verification. Without proper enforcement, an attacker could potentially gain the ability to send or receive data on the server, exposing confidentiality and integrity of the traffic.

The vulnerability affects Apache Traffic Server releases from 8.0.0 to 8.1.9, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3. Users running any of these version ranges are impacted.

The CVSS score of 7 indicates high severity, but the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, reducing the likelihood of known attacks. The attack vector is inferred to be local or remote access to a UDS listener; the explicit prerequisites are not detailed, so the risk remains elevated for environments where the listener is exposed. Given the high severity scoring, administrators should treat this flaw as a critical remediation priority.