CVE-2026-111814

Summary

Apache Traffic Server incorrectly reuses pooled TLS sessions across transactions that require different client certificates due to a flawed session-sharing policy, allowing an attacker to impersonate another client by hijacking a reused authenticated session.

Exploitability

Exploitation requires network access to the proxy and the ability to trigger multiple backend requests that share the same TLS session but expect different client certificates; no authentication or user interaction is needed.

Blast radius

An attacker could gain unauthorized access to backend services by presenting credentials from a reused session, potentially leading to data exfiltration or privilege escalation depending on backend access controls.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which explicitly fix the session-sharing policy to prevent cross-transaction certificate reuse.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.