CVE-2026-58189: Apache Traffic Server SSRF Vulnerability

CVE-2026-58189 Overview

CVE-2026-58189 is a Server-Side Request Forgery (SSRF) amplification vulnerability in Apache Traffic Server (ATS). The flaw allows attackers to bypass the redirect-follow limit when plugins reset the retry counter. This turns a bounded HTTP client into an unbounded redirect follower under attacker control. The Apache Software Foundation confirms the issue affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Fixed builds are available in 9.2.15 and 10.1.4. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
A remote attacker can drive an ATS proxy through an unbounded chain of HTTP redirects, amplifying SSRF reach into internal networks and exhausting downstream availability.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58189 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58189

Vulnerability Analysis

Apache Traffic Server enforces a maximum number of redirects it will follow on behalf of a client request. This limit exists to prevent redirect loops and to bound outbound requests generated by the proxy. The vulnerability arises because ATS plugins can reset the retry counter that tracks redirect depth. When a plugin resets this counter mid-chain, the built-in ceiling no longer applies. The proxy then continues following Location headers well past the configured threshold.

An attacker who can influence a request that traverses ATS, or who can point ATS at an attacker-controlled origin, gains a primitive for issuing many chained outbound requests. Because ATS makes these requests from its own network position, the attacker can reach internal services that the client cannot directly address. The impact is classified under [CWE-918] and is scored as a high-severity availability and SSRF issue.

Root Cause

The root cause is inconsistent state management between the core redirect handler and plugin hooks. The redirect-follow depth counter is not treated as authoritative. Plugin logic that resets or overwrites the counter is trusted without re-validation against the configured maximum. See the Apache Mailing List Discussion for the maintainer discussion.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a request through the proxy to an origin that returns a chain of HTTP 3xx responses. Each hop rewrites the Location target. When a loaded plugin resets the retry counter during processing, ATS continues to follow the chain. The attacker can direct the chain to internal RFC1918 addresses, loopback services, or cloud metadata endpoints, amplifying reach and consuming proxy resources.

No verified public proof-of-concept code is available. Technical detail is described in prose per the Apache advisory.

Detection Methods for CVE-2026-58189

Indicators of Compromise

Outbound HTTP requests from ATS instances to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) that do not match normal origin configuration.
High volumes of sequential 3xx responses observed in ATS access logs for a single client transaction ID.
Unusual spikes in ATS worker thread count or socket usage tied to a small number of client sessions.
Cache log entries showing repeated Location rewrites for the same upstream request.

Detection Strategies

Alert on ATS access logs where the redirect count per transaction exceeds the configured proxy.config.http.number_of_redirections value.
Correlate ATS outbound connections against an allowlist of legitimate origin servers and flag deviations.
Track version banners across the ATS fleet and flag hosts running 8.x, 9.0.0–9.2.14, or 10.0.0–10.1.3.

Monitoring Recommendations

Ingest ATS access, error, and diagnostic logs into a centralized SIEM for redirect-depth analysis.
Baseline outbound request volume from proxies and alert on deviations that suggest SSRF amplification.
Monitor egress firewall logs for proxy-originated traffic to metadata services or internal management planes.

How to Mitigate CVE-2026-58189

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 as recommended by the Apache Software Foundation.
Inventory all deployed ATS plugins and audit any that interact with redirect handling or the retry counter.
Restrict egress from ATS hosts so that the proxy cannot reach internal management networks or cloud metadata endpoints.
Review ATS access logs for the past 90 days to identify prior abuse of long redirect chains.

Patch Information

Apache Traffic Server 9.2.15 and 10.1.4 contain the fix. Users on the 8.x branch have no fixed release in the advisory and should migrate to a supported 9.2.15 or 10.1.4 build. See the Apache Mailing List Discussion for release details.

Workarounds

Disable third-party plugins that manipulate redirect state until they can be reviewed against the patched behavior.
Set proxy.config.http.redirection_enabled to 0 in records.config if server-side redirect following is not required.
Enforce strict egress network access control lists on ATS hosts to block traffic to internal-only ranges.

bash

# Configuration example: disable proxy-side redirect following in records.config
CONFIG proxy.config.http.redirection_enabled INT 0
CONFIG proxy.config.http.number_of_redirections INT 0