Bug 2546624

Summary:	CVE-2026-102795 trafficserver: trafficserver: Security restriction bypass via improper access control [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Joel Chamberlain <jochambe>
Component:	trafficserver	Assignee:	Jered Floyd (Fedora) <jered>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	epel10	CC:	jered
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["772e3fff-270e-4b3d-9cce-60cd09db7259"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-06 15:11:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2545303

Description Joel Chamberlain 2026-10-06 14:47:53 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Improper Access Control vulnerability in Apache Traffic Server.



This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.



Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.



This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

Comment 1 Jered Floyd (Fedora) 2026-10-06 15:11:26 UTC


*** This bug has been marked as a duplicate of bug 2508594 ***