Description
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.



Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Certificate spoofing
Action: Immediate Patch
AI Analysis

Impact

The certifier plugin in Apache Traffic Server builds SSL certificates using the SNI value supplied by the client. Because the SNI is not validated, an attacker can cause the server to generate a certificate for any arbitrary domain name. Based on the description, it is inferred that these forged certificates could be used to impersonate the alleged domain, potentially allowing man‑in‑the‑middle attacks.

Affected Systems

Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. The vendor recommends upgrading to at least 9.2.15 or 10.1.4 to address the issue.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, indicating a high severity. The EPSS score is less than 1 %, pointing to a low likelihood of exploitation at the time of assessment, and the flaw is not listed in the CISA KEV catalog. An attacker can trigger the issue remotely by supplying a malicious SNI in an HTTPS request; no local code execution is required after the patch is applied.

Generated by OpenCVE AI on October 1, 2026 at 23:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to at least version 9.2.15 or 10.1.4 to apply the vendor fix.
  • If an upgrade cannot be performed immediately, remove or disable the certifier plugin from the configuration to prevent certificate generation based on unvalidated SNI values.
  • Implement validation of incoming SNI values against a trusted whitelist before certificate creation, or configure TLS settings to reject certificates for domains not matching the expected list to reduce exposure.

Generated by OpenCVE AI on October 1, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Thu, 30 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T17:01:01.772Z

Reserved: 2026-06-29T15:51:05.609Z

Link: CVE-2026-58162

cve-icon Vulnrichment

Updated: 2026-07-29T13:41:01.343Z

cve-icon NVD

Status : Modified

Published: 2026-07-29T10:16:41.927

Modified: 2026-10-01T18:17:24.277

Link: CVE-2026-58162

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T00:00:15Z

Weaknesses
  • CWE-295

    Improper Certificate Validation