Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3…

A vulnerability identified as CVE-2026-41920 has been disclosed in Apache Traffic Server, involving Improper Access Control. The issue affects Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3. The vulnerability could allow unauthorized access due to improper enforcement of access controls within the software. Users and administrators running affected versions are strongly advised to upgrade to the patched releases: version 9.1.15 or 10.1.4. The fix has been officially released and documented by the Apache Software Foundation. No specific exploitation details or active in-the-wild exploitation have been mentioned in this advisory. The vulnerability was published via the NVD (National Vulnerability Database) and referenced through the Apache mailing list.