# CVE-2026-111811: Apache Traffic Server tsmemcache plugin unauthenticated cache access

Source: https://junglewise.ai/threats/cve-2026-111811-apache-traffic-server-s-experimental-tsmemcache-plugin-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111811 · Severity: critical · CVSS 9 · Published 2026-10-21

Apache Traffic Server is a proxy that caches web content to accelerate network performance. The tsmemcache plugin, an experimental feature, allows attackers from the network to read, modify, or delete cached data without any authentication, potentially exposing sensitive business information or disrupting proxy operations.

Technologies: [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111811 being exploited in the wild.

**How severe is CVE-2026-111811?** Critical severity, with a CVSS score of 9, published 21 October 2026.

**Which products and versions are affected?** Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0.

**Is there a fix for CVE-2026-111811?** Yes: fixed in 9.2.16, 10.1.5, 10.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111811 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111811?** Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.2.16, 10.1.5, 10.2.1

## Technical details

The tsmemcache plugin in Apache Traffic Server lacks authentication controls on memcache protocol operations, allowing unauthenticated network-based read, write, and deletion of the shared proxy cache. This is a network-accessible vulnerability requiring no prior authentication or user interaction. An attacker can exfiltrate cached data, corrupt cache contents, or cause denial of service.

## Affected products

- Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc](https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc)

## Related threats

- [Apache Traffic Server null pointer dereference in request tear-down](https://junglewise.ai/threats/cve-2026-112381-apache-traffic-server-can-crash-with-a-null-pointer-dereference)
- [Apache Traffic Server connection stall with chunked transfer trailers dropped](https://junglewise.ai/threats/cve-2026-111817-apache-traffic-server-can-stall-a-chunked-transfer-that-it)
- [Apache Traffic Server TLS session resumption bypass of client certificate verification](https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni)
- [Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy)
- [Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client)