{"id":"CVE-2026-111811","published":"2026-10-21T20:17:22.920","lastModified":"2026-10-26T10:10:00.140","description":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The experimental tsmemcache plugin in Apache Traffic Server versions 8.x through 8.1.11, 9.x through 9.2.15, and 10.x through 10.1.4/10.2.0 lacks authentication for cache operations, allowing unauthenticated network-based read, write, and deletion of the shared proxy cache.","exploitability":"Exploitation requires network access to the tsmemcache plugin endpoint; the high attack complexity (AC:H) suggests non-trivial conditions such as specific configuration or timing, but no authentication is required.","blast_radius":"An attacker could corrupt or exfiltrate cached content, potentially leading to data integrity compromise, cache poisoning, or denial of service for downstream clients relying on the proxy cache.","remediation":"Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which explicitly fix the unauthenticated cache access vulnerability in the tsmemcache plugin.","detection":"Monitor for unusual tsmemcache protocol traffic (e.g., non-GET/SET commands from unexpected sources) in logs generated by the memcache plugin or network captures; no specific log field or signature is named in the description, so defenders should look for anomalous cache manipulation attempts against the plugin.","tags":["cache-poisoning","unauthenticated-access","tsmemcache","proxy-cache","cwe-306"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:54:17.282Z"}}