CVE-2026-111812
Description
A flaw was found in Apache Traffic Server's origin_server_auth plugin. An unauthenticated remote attacker can exploit this vulnerability to force the proxy into signing attacker-controlled Amazon Web Services (AWS) request headers using the proxy server's own credentials. This allows the attacker to forge authorization signatures and access or compromise backend cloud infrastructure with the proxy's delegated privileges.
Statement
This vulnerability is rated as Moderate impact because it requires a specific, non-default configuration utilizing the optional origin_server_auth plugin to sign outbound upstream traffic. In typical deployments, proxy instances do not sign requests on behalf of clients, significantly limiting overall exposure. If an attacker can send arbitrary requests through a proxy configured with this plugin for AWS authentication, they may manipulate signed headers to act under the proxy's IAM permissions, but the exploit is constrained to the permissions granted to that proxy's identity.
Understanding the Weakness (CWE)
Access Control,Integrity
Technical Impact: Bypass Protection Mechanism; Modify Application Data
An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
