CVE-2026-58159

This CVE targets Apache Traffic Server and exposes a fundamental authorization flaw when Unix Domain Sockets interact with the system's IP-based ACL enforcement. The vulnerability is straightforward in concept but dangerous in practice: ACL rules designed to restrict access based on client IP addresses fail to correctly evaluate connections arriving via UDS, because UDS has no IP address—the filesystem path is the identity, not a network endpoint. When the ACL matcher encounters a UDS connection, it either cannot evaluate the rule correctly or falls back to an implicit permit, allowing the connection through regardless of configured restrictions. If you're running ATS 8.0.0 through 10.1.3 with any ACL-configured remap rules, untrusted local processes can bypass those controls by connecting through a UDS endpoint that should be restricted. This converts a network-facing proxy into a local privilege escalation vector—compromised or low-privilege code on the same host can abuse the proxy's network position and reputation to reach destinations the ACL was meant to block. Immediate actions: upgrade to 9.2.15 or 10.1.4 (the version split suggests different patches per branch—pick the one matching your major version). Review all remap rules that reference src_ip ACL conditions; audit whether any UDS endpoints exist in your configuration that should be subject to access restrictions. Document this interaction in your deployment notes—the fix likely adds conditional logic checking 'is this UDS?' rather than redesigning UDS as a first-class security principal, so future feature additions touching socket handling could regress the same bypass. Treat UDS endpoints as explicitly untrusted until proven otherwise in your threat model; do not assume ACL restrictions apply to local socket connections.

Reviewed through automated stages and approved by a human before publication.