CVE-2026-58162: Apache Traffic Server certifier plugin flaw
TL;DR - Critical Apache Traffic Server flaw in the
certifierplugin lets certificate generation depend on attacker-controlled TLS SNI. - Affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. - Upgrade urgently to 9.2.15 or 10.1.4; no CISA KEV confirmation or verified public PoC is currently known.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-58162 |
| CVSS | 10.0 |
| Attack vector | Unknown from currently available NVD data |
| Privileges required | Unknown from currently available NVD data |
| Patch available | Yes |
CVE-2026-58162 is a critical vulnerability in the Apache Traffic Server certifier plugin. The NVD description states that the plugin generates certificates based on attacker-controlled client SNI. That is the key fact defenders should focus on: a trust-sensitive certificate generation path is influenced by untrusted client input during TLS negotiation.
From an operational perspective, this is a serious issue even though some scoring details remain unavailable in the source material currently accessible. The CVSS base score is 10.0, which signals maximum severity, and the affected version ranges span several release branches. Where exact score vector fields are not published or not retrievable, defenders should assume worst-case exposure until they verify their own deployment specifics and patch level.
What Is This Vulnerability?
The root cause, as currently described by NVD, is that the Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. SNI, or Server Name Indication, is a value supplied by the client during the TLS handshake to indicate the hostname it wants to connect to. Because the client controls this field, it should be treated as untrusted input.
Using attacker-controlled SNI to drive certificate generation creates a trust-boundary failure. Certificate issuance and identity assertions are foundational security functions. If a plugin responsible for generating certificates relies on a client-supplied hostname without sufficient validation, policy enforcement, or binding to trusted backend configuration, an attacker may be able to influence what identity material gets created. The NVD description does not provide deeper implementation details, so it would be inappropriate to claim a specific abuse path beyond that. Still, the security implication is clear: untrusted network input is affecting certificate generation logic, which can undermine authentication and trust assumptions.
Technical Notes
A simplified view of the risky data flow looks like this:
Client TLS handshake
-> client supplies SNI value
-> Traffic Server certifier plugin consumes SNI
-> certificate generation logic uses that SNI
-> trust-sensitive output influenced by attacker-controlled input
Defenders should not assume the flaw is harmless because it sits in a plugin. In many Traffic Server deployments, plugin-based features are part of the live request path and can materially change how TLS is terminated and presented to clients.
Who Is Affected?
According to the NVD description, the following Apache Traffic Server versions are affected:
8.0.0 through 8.1.99.0.0 through 9.2.1410.0.0 through 10.1.3
The issue is specifically tied to the certifier plugin. That means the first scoping question is not only “What Traffic Server version am I running?” but also “Is the certifier plugin installed or enabled in this environment?” Organizations that run Apache Traffic Server for TLS interception, reverse proxying, or certificate-related workflows should prioritize checking for this plugin immediately.
The fix versions identified by NVD are 9.2.15 and 10.1.4. No fixed 8.x version is identified in the available source material. If you are on the 8.x branch, do not assume a patch exists for that line. In the absence of a stated 8.x fix, defenders should assume that migration to a supported branch or disabling the affected functionality may be necessary until upstream guidance says otherwise.
Technical Notes
Useful local version checks include package-manager queries and binary version output:
traffic_server -V
rpm -qa | grep -i trafficserver
dpkg -l | grep -i trafficserver
To identify whether the plugin is configured, review Traffic Server plugin configuration files for references to certifier:
grep -Rin "certifier" /etc/trafficserver /usr/local/etc/trafficserver 2>/dev/null
CVSS Score Breakdown
The published base score is 10.0, which is the maximum CVSS severity. However, the full vector string was not available in the retrieved NVD data used for this article. That means fields such as attack vector, attack complexity, privileges required, user interaction, scope, and confidentiality/integrity/availability impacts cannot be quoted verbatim here without inventing details.
Even without the full vector, the severity is still meaningful. A 10.0 score usually indicates a remotely significant issue with broad impact and little practical friction to exploitation. In this case, the fact that attacker-controlled TLS SNI influences certificate generation is consistent with a high-confidence, high-impact trust problem. For defenders, the practical takeaway is simple: treat this as an urgent fix item rather than waiting for fuller scoring metadata to appear.
The uncertainty around the missing vector should not slow remediation. If your change management process requires a score rationale, use the NVD’s 10.0 base score and the root-cause description as the basis for emergency review. For internet-facing proxies or edge systems, certificate-handling flaws deserve priority because they can affect downstream trust relationships well beyond a single host.
Exploitation Status
At the time of writing, CISA’s Known Exploited Vulnerabilities catalog does not list CVE-2026-58162. That means there is currently no CISA-confirmed evidence of in-the-wild exploitation from the KEV catalog. This is useful context, but it is not evidence of safety. KEV non-listing only means public confirmation is absent from that source at this time.
A verified public proof-of-concept was also not confirmed from the source material available for this article. The Apache project repository and issue tracker were identified during research, but no specific exploit repository, exploit write-up, or PoC code tied to this CVE could be verified from those sources. Therefore, the current status is: no confirmed active exploitation in KEV, and no verified public PoC from the retrieved sources.
Defenders should assume that the lack of a public PoC may be temporary. Critical certificate-related issues in widely deployed edge software often attract rapid analysis from researchers and attackers alike. If your deployment is internet-facing and uses the affected plugin, do not wait for exploitation confirmation before acting.
How to Detect It
Detection is difficult because the public description does not yet include a detailed exploit sequence or reliable indicators of compromise. Still, defenders can look for suspicious or unusual SNI values in TLS handshake logs, reverse-proxy access telemetry, or packet captures. The key behavioral question is whether clients are supplying unexpected hostnames that could trigger certificate-generation code paths.
You should also review Traffic Server configuration and runtime logs for plugin loading and certificate-related errors or events. Since the flaw is in the certifier plugin, visibility into plugin activity is important. Environments that terminate large volumes of TLS traffic should baseline normal SNI patterns, then alert on anomalous names, malformed hostnames, internal-only domains presented by external clients, or spikes in previously unseen SNI values.
Technical Notes
Example grep patterns for hunting suspicious certificate- or SNI-related events in Traffic Server logs:
grep -RinE "certifier|SNI|certificate|TLS|ssl" /var/log/trafficserver 2>/dev/null
Example Splunk-style query for environments that ingest proxy or TLS handshake logs:
index=proxy OR index=tls
("SNI=" OR "server_name=" OR "tls.server_name=")
| stats count by src_ip, sni
| where count > 50
Example Sigma-like detection idea for anomalous SNI values:
title: Suspicious TLS SNI Values Targeting Traffic Server
logsource:
product: proxy
detection:
selection:
sni|contains:
- ".local"
- ".internal"
- ".."
- "*"
condition: selection
level: medium
Example Zeek query pattern if TLS logs are available:
cat tls.log | jq -r 'select(.server_name != null) | [.id.orig_h, .server_name] | @tsv'
These examples are heuristic only. Because no authoritative detection signatures were published in the provided source set, defenders should tune for their own environment and prioritize patch verification over IOC-based hunting.
Mitigation and Patching
The NVD states that users should upgrade to 9.2.15 or 10.1.4, which fix the issue. If you are currently on 9.0.0 through 9.2.14, the target version is 9.2.15. If you are on 10.0.0 through 10.1.3, the target version is 10.1.4. Those are the only fixed versions explicitly identified in the available source material.
For systems on the 8.0.0 through 8.1.9 branch, the currently available NVD description does not name a fixed 8.x release. In the absence of that data, defenders should assume there may be no patched 8.x version and plan accordingly. The safest course is to migrate to a supported fixed branch. If immediate upgrade is not possible, review whether the certifier plugin can be disabled without breaking business-critical traffic flows.
Workarounds should focus on reducing exposure from the affected component. If the certifier plugin is enabled but not strictly required, disable it and restart Traffic Server under a tested maintenance process. If it is required for a critical service, place compensating controls around exposed entry points, restrict client reachability where possible, and shorten the window to full upgrade.
Technical Notes
Check whether the plugin is enabled:
grep -Rin "certifier" /etc/trafficserver /usr/local/etc/trafficserver 2>/dev/null
If your deployment model supports package-based upgrades, the exact package name varies by distribution, but the workflow typically resembles:
sudo apt update
sudo apt install trafficserver=<fixed-version>
sudo dnf upgrade trafficserver
sudo yum update trafficserver
If you build from source, verify the installed release after upgrade:
traffic_server -V
A generic workaround to disable the affected plugin is to remove or comment out its entry from Traffic Server plugin configuration, then reload or restart the service according to your change window. Because deployment paths vary, validate configuration syntax before restart.
sudo cp /etc/trafficserver/plugin.config /etc/trafficserver/plugin.config.bak
sudo sed -i '/certifier/s/^/#/' /etc/trafficserver/plugin.config
sudo systemctl restart trafficserver
Use the exact paths and service names for your platform. Test in staging before production rollout, especially if Traffic Server handles TLS termination for customer-facing services.
References
The primary source for this CVE is the NVD record, which states that the Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI, identifies affected versions, and names the fixed releases. That is the most reliable public source currently available from the provided research set.
An Apache mailing list advisory thread is referenced by NVD, but the retrieved page content was JavaScript-dependent and did not expose additional advisory text in the accessible response used here. Project repository and issue tracker pages help validate product identity, but they were not used to infer unverified exploit or patch details.
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-58162
- Apache advisory thread referenced by NVD: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d
- Apache Traffic Server GitHub repository: https://github.com/apache/trafficserver
- Apache Traffic Server issue tracker: https://github.com/apache/trafficserver/issues
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
If you operate Apache Traffic Server with the certifier plugin enabled, the practical action is clear: identify affected instances, verify whether the plugin is in use, and move to 9.2.15 or 10.1.4 as quickly as your change process allows. For 8.x, assume migration planning is required unless upstream guidance later states otherwise.
For further information on building a practical vulnerability management program, check out our article on how to build a practical vulnerability management program. Additionally, you can learn more about the latest CVEs, such as CVE-2026-60102, by visiting our dedicated page here.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.