Apache Traffic Server: Missing authentication in tsmemcache plugin
Summary
The experimental tsmemcache plugin of Apache Traffic Server allows unauthenticated network access to the shared proxy cache, enabling an attacker to read, write and delete cached content. Exposure requires that the plugin is loaded and its network port is reachable from other hosts. The ASF rates the issue moderate (CVSS 3.1 9.0), while the CVSS 4.0 score in the CVE record is 9.4; NVD analysis is still pending.
Affected
- Apache Traffic Server 8.0.0 through 8.1.11
- Apache Traffic Server 9.0.0 through 9.2.15
- Apache Traffic Server 10.0.0 through 10.1.4
- Apache Traffic Server 10.2.0 (default configuration: unaffected)
Fixed in
- 9.2.16 or later (9.2.x line)
- 10.1.5 or later (10.1.x line)
- 10.2.1 or later (10.2.x line)
- 8.x: Unknown. No fixed 8.x release found; treat as end-of-life or unpatched and confirm with the ASF.
Workaround
- No official workaround found.
- Interim measure (not a vendor instruction): remove the tsmemcache line from plugin.config, restart ATS, and block the memcache port (default 11211) from untrusted networks.
Exploitation
- No confirmed exploitation in the wild; not listed in CISA KEV.
- One secondary report claims a proof of concept exists; this is unverified and no public PoC was found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether ATS is deployed and whether the tsmemcache plugin is enabled in plugin.config.
- If it is enabled and reachable from untrusted networks, prioritise the update to 9.2.16, 10.1.5 or 10.2.1, or disable the plugin and block the port as an interim measure.
- Replace 8.x installations, as no fixed 8.x release was found.
- Monitor the shared cache for unexpected changes or deletions.
- If ATS is not used, no action needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list announcement lists.apache.org
- Ubuntu security notice ubuntu.com
- HOL CVE details hol.org
- Apache Traffic Server memcache plugin documentation docs.trafficserver.apache.org
- Vulners CVE record (CNA data) vulners.com
- Rescana analysis www.rescana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:57.
Original description (NVD)
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.