CVE-2026-111811 in Traffic Server
Summary
by MITRE • 10/22/2026
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The Apache Traffic Server experimental tsmemcache plugin introduces a critical security vulnerability that allows unauthenticated actors to perform read, write, and deletion operations against the shared proxy cache. This flaw stems from an insufficient access control mechanism within the memcached protocol implementation embedded in this specific module. Because the plugin is designed to interface with external systems using the Memcached binary or text protocols, it inadvertently exposes internal caching infrastructure to any network client that can reach the service port without requiring authentication credentials. The experimental nature of the component often implies that default configurations may not enforce strict security boundaries, leading to a situation where the boundary between trusted administrative operations and untrusted public access is effectively non-existent.
From a technical perspective, this vulnerability represents a classic case of broken access control where the server fails to verify the identity or permissions of the requesting client before executing cache manipulation commands. An attacker who gains network connectivity to the affected Apache Traffic Server instance can exploit this by sending crafted Memcached protocol requests. These requests can include GET operations to exfiltrate sensitive data stored in the proxy cache, SET operations to inject malicious content into cached responses which may then be served to legitimate users, or DELETE operations to cause denial of service by removing critical cached assets. The impact is severe because the shared proxy cache often contains dynamic content that has undergone authentication and authorization checks; bypassing these layers allows an attacker to access data they should not see or alter application behavior without detection.
The operational impact extends beyond simple data leakage. By writing malicious payloads into the cache, an attacker can facilitate persistent cross-site scripting attacks or serve compromised files to a wide range of users who rely on the proxy for content delivery. This effectively turns the caching layer from a performance optimization tool into a weaponized vector for web application attacks. Furthermore, the ability to delete cached items can lead to resource exhaustion as the system attempts to regenerate lost cache entries, potentially causing latency spikes or complete service unavailability under load. The vulnerability affects multiple major versions of Apache Traffic Server, including 8.x through 9.2.15 and 10.x up to specific patch levels, indicating a systemic issue in how the experimental plugin was architected across different releases rather than an isolated coding error in a single version.
This incident aligns with CWE-287 Improper Authentication and CWE-434 Unrestricted Upload of File with Dangerous Type if interpreted through the lens of data integrity, though primarily it is categorized under CWE-922 Insecure Storage of Sensitive Information due to the unauthorized read access. Within the MITRE ATT&CK framework, this vulnerability enables techniques associated with Collection via Local Network Sniffing or Remote Services depending on network topology, and specifically relates to T1078 Valid Accounts if credentials were required but bypassed, though here it is more accurately mapped to unauthenticated exploitation of remote services. The lack of authentication for such high-privilege operations violates the principle of least privilege, granting broad control over critical infrastructure components without verification.
To mitigate this risk, organizations running affected versions must upgrade immediately to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, where these access control flaws have been addressed. If upgrading is not immediately feasible, administrators should consider disabling the tsmemcache plugin entirely if it is not strictly required for current operations, as experimental plugins may lack mature security hardening. Additionally, network-level controls such as firewall rules restricting access to the memcached port to only trusted internal subnets can provide a layer of defense in depth, although this does not replace the need for proper application-layer authentication and authorization mechanisms within the plugin itself. Regular auditing of enabled modules and adherence to vendor-recommended secure configurations are essential practices to prevent similar exposures in future deployments.