CVE-2026-111814
Description
A flaw was found in Apache Traffic Server. Its default outbound session-sharing policy can reuse an existing Transport Layer Security (TLS) connection authenticated with one client certificate for a transaction configured to present a different certificate. A remote attacker could exploit this flaw to bypass mutual TLS authentication without valid credentials, potentially gaining unauthorized access across tenant boundaries.
Statement
This vulnerability is rated as Important because reusing established mutual TLS sessions across different client credentials allows unauthorized identity spoofing and upstream access control bypass. Apache Traffic Server is not provided in Red Hat Enterprise Linux or core Red Hat application distributions, limiting exposure across supported platforms. The flaw only impacts environments configured to route traffic to origin servers using multiple client certificates while retaining default connection pooling settings.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
The impact of insecure defaults varies widely depending on the functionality that the product controls.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
