Description
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The certifier plugin in Apache Traffic Server trusts the client‑supplied Server Name Indication (SNI) to build SSL certificates. An attacker that can control the SNI value can therefore request that the server generate a certificate for any domain name, enabling impersonation of that domain and man‑in‑the‑middle attacks. This flaw is categorized as CWE‑295, which indicates an insecure trust of user‑provided data without proper validation.

Affected Systems

Deployments of Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. These releases are provided by the Apache Software Foundation and must be updated to mitigate the vulnerability.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, indicating a high severity. The EPSS score is less than 1 %, pointing to a low likelihood of exploitation at the time of assessment, and the flaw is not listed in the CISA KEV catalog. An attacker can trigger the issue remotely by supplying a malicious SNI in an HTTPS request; no local code execution is required after the patch is applied.

Generated by OpenCVE AI on August 3, 2026 at 13:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to at least version 9.2.15 or 10.1.4 to apply the vendor fix.
  • If an upgrade cannot be performed immediately, remove or disable the certifier plugin from the configuration to prevent certificate generation based on unvalidated SNI values.
  • Implement validation of incoming SNI values against a trusted whitelist before certificate creation, or configure TLS settings to reject certificates for domains not matching the expected list to reduce exposure.

Generated by OpenCVE AI on August 3, 2026 at 13:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T13:41:05.355Z

Reserved: 2026-06-29T15:51:05.609Z

Link: CVE-2026-58162

cve-icon Vulnrichment

Updated: 2026-07-29T13:41:01.343Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T10:16:41.927

Modified: 2026-08-03T19:35:27.323

Link: CVE-2026-58162

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T13:45:03Z

Weaknesses
  • CWE-295

    Improper Certificate Validation