CVE-2026-111811

Summary

The experimental tsmemcache plugin in Apache Traffic Server versions 8.x through 8.1.11, 9.x through 9.2.15, and 10.x through 10.1.4/10.2.0 lacks authentication for cache operations, allowing unauthenticated network-based read, write, and deletion of the shared proxy cache.

Exploitability

Exploitation requires network access to the tsmemcache plugin endpoint; the high attack complexity (AC:H) suggests non-trivial conditions such as specific configuration or timing, but no authentication is required.

Blast radius

An attacker could corrupt or exfiltrate cached content, potentially leading to data integrity compromise, cache poisoning, or denial of service for downstream clients relying on the proxy cache.

Detection

Monitor for unusual tsmemcache protocol traffic (e.g., non-GET/SET commands from unexpected sources) in logs generated by the memcache plugin or network captures; no specific log field or signature is named in the description, so defenders should look for anomalous cache manipulation attempts against the plugin.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which explicitly fix the unauthenticated cache access vulnerability in the tsmemcache plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.