{"id":"CVE-2026-111814","published":"2026-10-21T20:17:23.190","lastModified":"2026-10-23T12:18:09.207","description":"Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-295"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Traffic Server incorrectly reuses pooled TLS sessions across transactions that require different client certificates due to a flawed session-sharing policy, allowing an attacker to impersonate another client by hijacking a reused authenticated session.","exploitability":"Exploitation requires network access to the proxy and the ability to trigger multiple backend requests that share the same TLS session but expect different client certificates; no authentication or user interaction is needed.","blast_radius":"An attacker could gain unauthorized access to backend services by presenting credentials from a reused session, potentially leading to data exfiltration or privilege escalation depending on backend access controls.","remediation":"Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which explicitly fix the session-sharing policy to prevent cross-transaction certificate reuse.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["tls-misconfig","session-hijack","auth-bypass","proxy"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:45:24.898Z"}}