CVE-2026-58159: Apache Traffic Server Auth Bypass Flaw

CVE-2026-58159 Overview

CVE-2026-58159 is an authorization vulnerability in Apache Traffic Server (ATS) that allows attackers to bypass IP-based access controls. The flaw affects Unix Domain Socket (UDS) listeners and results from Access Control List (ACL) matching errors. The Apache Software Foundation classifies this issue as [CWE-863: Incorrect Authorization]. Affected versions span 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users must upgrade to 9.2.15 or 10.1.4 to remediate the vulnerability.

Critical Impact
Remote attackers can bypass IP allow/deny rules configured in Apache Traffic Server, gaining unauthorized access to proxied resources without authentication.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58159 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58159

Vulnerability Analysis

Apache Traffic Server enforces IP-based access controls through ACL rules defined in configuration files such as ip_allow.yaml and remap.config. CVE-2026-58159 describes two related authorization defects. First, ACLs are not correctly applied to listeners bound to Unix Domain Sockets. Second, the ACL matching logic contains errors that permit requests to pass evaluation when they should be denied. Both conditions allow attackers to reach protected origin servers or administrative endpoints that the operator intended to restrict by source IP.

Root Cause

The root cause is incorrect authorization logic as categorized by [CWE-863]. ACL enforcement paths did not extend to UDS listeners, and the matching routines produced incorrect results for certain rule combinations. This resulted in a permit-by-default outcome when the operator's policy required denial. Consult the Apache Security Advisory for the maintainer's technical description.

Attack Vector

The vulnerability is exploitable over the network without authentication and without user interaction. An unauthenticated attacker sends HTTP requests to a vulnerable ATS instance and reaches resources that IP allow-lists should have blocked. Environments exposing UDS listeners or relying solely on ATS ACLs for perimeter enforcement face the greatest exposure. No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-58159

Indicators of Compromise

Requests to backend origins or administrative paths originating from source IPs outside the configured ip_allow.yaml ranges
Successful HTTP 200 responses to requests that ATS access logs previously denied with 403 status
Unexpected client connections to UDS listener sockets configured in records.yaml
Access log entries referencing internal or restricted hostnames from external network segments

Detection Strategies

Compare ATS access logs against configured ACL policy to identify requests that should have been blocked
Baseline expected client IPs per virtual host and alert on deviations reaching restricted endpoints
Inspect proxy metrics for spikes in requests from IPs not present in allow-list ranges
Correlate origin server logs with ATS logs to identify traffic bypassing intended source restrictions

Monitoring Recommendations

Enable verbose ATS access logging and forward logs to a centralized analytics platform for retention and query
Monitor the ATS installation for the running binary version and alert on hosts still executing unpatched builds
Track configuration drift on ip_allow.yaml, remap.config, and records.yaml using file integrity monitoring
Alert on any new UDS listener definitions introduced into ATS configuration

How to Mitigate CVE-2026-58159

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 on all affected hosts
Inventory ATS deployments and identify any instance running 8.x, since 8.x reached end of maintenance and is affected
Audit ip_allow.yaml rules and validate enforcement against test traffic after upgrade
Restrict network exposure of ATS listeners at the firewall layer until patches are applied

Patch Information

The Apache Software Foundation released Apache Traffic Server 9.2.15 and 10.1.4 to remediate CVE-2026-58159. Version 8.x is not receiving a patch and users must migrate to a supported branch. Full details are available in the Apache Security Advisory.

Workarounds

Enforce IP restrictions at an upstream firewall or load balancer rather than relying on ATS ACLs alone
Disable UDS listeners in ATS configuration if they are not required for the deployment
Place ATS behind an authenticated reverse proxy that validates client identity independently of source IP

bash

# Verify installed Apache Traffic Server version
traffic_server -V

# Example ip_allow.yaml enforcing default-deny after upgrade
# ip_allow:
#   - apply: in
#     ip_addrs: 10.0.0.0/8
#     action: allow
#     methods: all
#   - apply: in
#     ip_addrs: 0.0.0.0/0
#     action: deny
#     methods: all