Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 2 advisories

CVE-2026-41920

Improper Access Control vulnerability in Apache Traffic Server

CVE-2026-41920: Improper Access Control vulnerability in Apache Traffic Server. Not in the CISA KEV catalog. High advisory severity (CVSS 7, Apache).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Apache publishes the next one.

VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-41920 key facts

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
7 (Apache)
Fixed releases
  • Apache: 9.1.15, 10.1.4
Vendor advisories
2 from Apache
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-41920; bulletin-wide values are not repeated here.

Is CVE-2026-41920 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-41920 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-41920?

Upgrade to a fixed release named by the vendor:

  • Apache: 9.1.15, 10.1.4
  • Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue. (Apache)

Vendor advisory comparison

Apache

2 advisories
  • Advisory severityHigh7.0

    High [CVE-2026-102795 +1] Improper Access Control vulnerability in Apache Traffic Server

    CVE-2026-102795Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

    Affected products in this advisory
    • Apache Traffic Server
    Source-reported affected versions
    • 9.0.0 through 9.2.14
    • 10.0.0 through 10.1.3.
    • through 10.1.3
    • through 9.1.14
    Source-reported fixed versions
    • 9.2.15
    • 10.1.4
    Mitigation guidance
    • Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityHigh7.0

    High [CVE-2026-41920] Improper Access Control vulnerability in Apache Traffic Server

    CVE-2026-41920Source published Source updated

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

    Affected products in this advisory
    • Apache Traffic Server
    Source-reported affected versions
    • 9.0.0 through 9.1.14
    • 10.0.0 through 10.1.3.
    • through 10.1.3
    Source-reported fixed versions
    • 9.1.15
    • 10.1.4
    Mitigation guidance
    • Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

More Apache advisories

All Apache advisories

Follow CVE-2026-41920 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Apache CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features