CVE-2026-111812

Summary

The origin_server_auth plugin in Apache Traffic Server incorrectly allows clients to influence which AWS headers are signed by the proxy's credentials due to improper validation of header selection, enabling attackers to forge authenticated requests to AWS services using the proxy's identity.

Exploitability

Exploitation requires network access to the proxy and knowledge of the target AWS service endpoint; no authentication or user interaction is needed.

Blast radius

An attacker could forge AWS API requests (e.g., S3, EC2) with full trust of the compromised proxy's IAM role, potentially leading to unauthorized data access, modification, or deletion across AWS resources accessible to that role.

Detection

Monitor for anomalous AWS API calls logged by the proxy where header signing does not match expected request patterns; specifically, look for requests signed with the proxy's credentials that include non-standard or attacker-controlled headers in the canonical string.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.