CVE-2026-58186: Apache Traffic Server Info Disclosure Flaw

CVE-2026-58186 Overview

CVE-2026-58186 affects the webp_transform plugin in Apache Traffic Server (ATS). The plugin decodes image content unsafely and serves mislabeled, cacheable responses to clients. Unsafe decoding combined with incorrect content labeling allows attackers to influence proxy behavior and poison downstream caches. The flaw maps to improper input validation [CWE-20] and impacts availability of the caching proxy.

The issue affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation released fixed builds in versions 9.2.15 and 10.1.4.

Critical Impact
A network attacker can trigger unsafe image decoding and cause Apache Traffic Server to cache and serve mislabeled responses to other clients.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58186 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58186

Vulnerability Analysis

Apache Traffic Server ships the webp_transform plugin to convert images to WebP format on the fly. The plugin performs decoding without sufficient validation of the input image and its metadata. It then emits responses with incorrect labeling while allowing those responses to be stored in the shared cache.

Because Traffic Server operates as a forward and reverse proxy, mislabeled cacheable content propagates from a single request to many downstream consumers. Attackers who can reach the proxy over the network can influence what other users receive from cache. The result is a reliable availability impact on cached content served by the proxy tier.

Root Cause

The root cause is improper input validation [CWE-20] inside the webp_transform plugin's decoding path. The plugin trusts image inputs during decode and does not enforce correct response labeling before insertion into the object store. Cacheability rules are applied to the mislabeled response, so downstream clients see stale or wrongly typed content.

Attack Vector

Exploitation requires only network access to a Traffic Server instance running the webp_transform plugin. No authentication or user interaction is required. The attacker sends a crafted image request that traverses the plugin's decode path. Traffic Server then caches the mislabeled result and returns it to subsequent requesters, converting a single request into a broad service disruption. Refer to the Apache Security Discussion Thread for maintainer context.

Detection Methods for CVE-2026-58186

Indicators of Compromise

Cached responses served from Traffic Server with Content-Type values that do not match the underlying object bytes.
Elevated error rates or crashes in the webp_transform plugin worker threads.
Unusual volumes of image requests targeting endpoints that invoke WebP transformation.

Detection Strategies

Inventory Traffic Server nodes and confirm whether webp_transform is loaded via plugin.config or per-remap configuration.
Compare running traffic_server version output against the fixed versions 9.2.15 and 10.1.4.
Correlate proxy access logs with origin logs to identify responses where the content type diverges between tiers.

Monitoring Recommendations

Alert on client complaints or automated checks reporting mismatched MIME types from cached image URLs.
Track plugin restart events and decoder error counters exported by Traffic Server metrics.
Ingest proxy access logs into a centralized analytics platform to spot cache poisoning patterns across nodes.

How to Mitigate CVE-2026-58186

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 on all proxy nodes.
Audit plugin.config and remap rules to identify every instance where webp_transform is active.
Purge existing cache objects that were generated by the vulnerable webp_transform plugin before returning nodes to production.

Patch Information

The Apache Software Foundation fixed CVE-2026-58186 in Apache Traffic Server 9.2.15 and 10.1.4. Operators running any 8.x release must migrate to a supported branch, since the 8.x line does not have a fixed release listed. See the Apache Security Discussion Thread for release notes and upstream discussion.

Workarounds

Disable the webp_transform plugin until the upgrade is completed on each node.
Force Cache-Control: no-store for routes that would otherwise invoke the plugin, preventing mislabeled objects from persisting.
Restrict access to WebP transformation endpoints using upstream access controls where the plugin cannot be immediately removed.

bash

# Configuration example: disable the webp_transform plugin in plugin.config
# /usr/local/etc/trafficserver/plugin.config
# webp_transform.so   <-- comment out this line to disable the plugin

# Then reload Traffic Server configuration
traffic_ctl config reload

# Verify running version matches a fixed release
traffic_server -V