What is CVE-2026-41920?

CVE-2026-41920 is a critical-severity vulnerability in Apache Software Foundation Traffic Server, classified under Improper Access Control. CVSS score: 9.3/10. Published 2026-07-29.

How severe is CVE-2026-41920?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Vulnerability in Apache Software Foundation Traffic Server

CVE-2026-41920

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes th…

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N.

Affected products

Apache Software Foundation Traffic Server — versions 9.0.0, 10.0.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

security@apache.org (vendor-advisory)

Frequently asked questions

What is CVE-2026-41920?: CVE-2026-41920 is a critical-severity vulnerability in Apache Software Foundation Traffic Server, classified under Improper Access Control. CVSS score: 9.3/10. Published 2026-07-29.
How severe is CVE-2026-41920?: Critical severity. CVSS v3 base score is 9.3 out of 10.