CVE-2026-41920Apache Traffic Server: SNI to Host header matching policy is not properly enforced

7.0HighCVSS base score
0.53%Exploitation in 30 daysEPSS · top 55% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

Timeline

2026
22 Apr 2026
22 Apr 2026
ID reserved
By apache
29 Jul 20263 months later
29 Jul 2026· 3 months later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-41920, by who scored it
Scored by	CVSS	Score	Vector
apacheCNA (assigner)	4.0	High7.0	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
apacheCNA (assigner)	3.1	Critical9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
NVDNVD · Analyzed	4.0	High7.0	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.53% · top 55% of all CVEs (12 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Affected products

Apache Software Foundation · Apache Traffic Server
- affected 9.0.0 – ≤ 9.1.14
- affected 10.0.0 – ≤ 10.1.3

References1

https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-41920](https://cveledger.app/badge/CVE-2026-41920.svg)](https://cveledger.app/cve/CVE-2026-41920)

Record last updated 29 Jul 2026, 13:14 UTC.