Apache Traffic Server: Session reuse with wrong client certificate
Summary
Apache Traffic Server (ATS) with the default outbound session-sharing policy can reuse a pooled TLS session that was authenticated with one client certificate for a transaction configured to present a different one. An attacker who can influence requests through ATS may cause an origin server to accept the wrong client identity, which matters where origins use client certificates for access control. The NVD record rates the issue CVSS 4.0 7.8 (High), and the vendor rates it Important; the risk applies only where ATS presents client certificates (mTLS) to origin servers.
Affected
- Apache Traffic Server 9.0.0 through 9.2.15
- Apache Traffic Server 10.0.0 through 10.1.4
- Apache Traffic Server 10.2.0 (default configuration reported as unaffected)
Fixed in
- Apache Traffic Server 9.2.16
- Apache Traffic Server 10.1.5
- Apache Traffic Server 10.2.1
Workaround
Unknown.
- No vendor-documented workaround for the patched branches was found.
- Deployments that configure no outbound client certificate are reportedly unaffected.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- EPSS 0.00235 (very low).
- No public proof of concept found; this does not prove that none exists.
Our recommendation
- Identify all ATS instances and check whether they present client certificates (mTLS) to origin servers.
- Upgrade affected instances to 9.2.16, 10.1.5 or 10.2.1, prioritising those with mTLS to origins.
- Include the other October 2026 fixes from the same Apache release in the upgrade.
- Until patched, review whether origins rely on certificates for access control and monitor their access logs for unexpected client identities.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Traffic Server security advisory October 2026 trafficserver.apache.org
- Apache mailing list announcement lists.apache.org
- NVD mirror (Vulners) CVE-2026-111814 vulners.com
- Ubuntu security notice CVE-2026-111814 ubuntu.com
- CVE record mirror (ThreatInt) cve.threatint.com
- OpenCVE CVE-2026-111814 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:43.
Original description (NVD)
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.