Apache Traffic Server Cache Plugin Allows Unauthenticated Data Deletion

Apache Traffic Server’s experimental tsmemcache plugin contains a critical security flaw that allows unauthenticated network access to the shared proxy cache. According to the National Vulnerability Database, this weakness, identified as CVE-2026-111811, permits attackers to read, write, and delete cached data. The issue is associated with CWE-306.

Which versions are affected?

The vulnerability impacts a wide range of Apache Traffic Server releases. Affected versions include all builds from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, and from 10.0.0 through 10.1.4. Additionally, version 10.2.0 is also vulnerable. The Apache Software Foundation has identified these specific release windows as containing the insecure configuration in the tsmemcache plugin.

How severe is the risk?

The National Vulnerability Database assigns a CVSS score of 9.0 to CVE-2026-111811, rating it as Critical. This high severity reflects the unauthenticated nature of the access. Because the tsmemcache plugin allows unauthenticated access, no credentials are required to manipulate the cache. Attackers can potentially corrupt data, delete essential cache entries, or inject malicious content into the proxy’s shared storage.

What fixes are available?

Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue. These versions resolve the vulnerability present in earlier releases. Organizations running older versions should prioritize upgrading to one of these patched releases to prevent unauthorized cache manipulation.

What comes next for users?

Administrators must verify their current Apache Traffic Server version against the list of affected releases. Those running versions prior to the recommended builds should schedule immediate updates. Since the plugin is experimental, teams should also review whether the tsmemcache plugin is necessary for their deployment. Disabling unused experimental features can reduce the attack surface while updates are applied.

What analysts watch for

Teams usually monitor for unusual network traffic targeting cache ports. Analysts check for unexpected read or write operations from unauthenticated sources. They examine logs for rapid cache deletions or content modifications. Persistence often involves maintaining access to the cache for ongoing manipulation. Spread typically occurs when cached malicious content is served to end users. Investigators look for anomalies in cache hit rates and data integrity.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Apache Traffic Server

• Verify if your Apache Traffic Server installation includes the tsmemcache plugin.
• Check your current version against the list of affected releases.
• Upgrade to version 9.2.16, 10.1.5, or 10.2.1 if you are running a vulnerable version.
• Monitor network logs for unauthenticated access attempts to the cache interface.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-111811?

It is a critical vulnerability in Apache Traffic Server’s tsmemcache plugin that allows unauthenticated read, write, and delete access to the shared proxy cache.

Which versions of Apache Traffic Server are affected?

Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are affected.

How can I fix this vulnerability?

Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1.