CVE-2026-111811
Description
A flaw was found in Apache Traffic Server. When the experimental tsmemcache plugin is enabled, it fails to enforce authentication on incoming network connections. An unauthenticated remote attacker can exploit this flaw to inspect, modify, or delete entries in the shared proxy cache, leading to sensitive information disclosure and cache tampering.
Statement
This vulnerability is rated as having Important impact because an unauthenticated remote attacker can inspect, alter, or delete cached proxy data across the network, compromising the confidentiality and integrity of cached web sessions. However, exploitation is contingent upon explicitly configuring and enabling the experimental tsmemcache plugin, which is not loaded or active in default configurations. Deployments that do not explicitly enable this experimental plugin in their configuration are not exposed to this vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
