{"id":"CVE-2026-111812","published":"2026-10-21T20:17:23.060","lastModified":"2026-10-23T12:18:08.957","description":"Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The origin_server_auth plugin in Apache Traffic Server incorrectly allows clients to influence which AWS headers are signed by the proxy's credentials due to improper validation of header selection, enabling attackers to forge authenticated requests to AWS services using the proxy's identity.","exploitability":"Exploitation requires network access to the proxy and knowledge of the target AWS service endpoint; no authentication or user interaction is needed.","blast_radius":"An attacker could forge AWS API requests (e.g., S3, EC2) with full trust of the compromised proxy's IAM role, potentially leading to unauthorized data access, modification, or deletion across AWS resources accessible to that role.","remediation":"Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1 immediately.","detection":"Monitor for anomalous AWS API calls logged by the proxy where header signing does not match expected request patterns; specifically, look for requests signed with the proxy's credentials that include non-standard or attacker-controlled headers in the canonical string.","tags":["aws","auth-bypass","credential-theft","web-proxy","origin-server-auth"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:45:10.126Z"}}