CVE-2026-58189
Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplificationApache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
We have discovered 399 live websites that are affected by CVE-2026-58189.
Affected Software
| Product |  ATS |
| Category | Web Servers |
| Vulnerable Domains | 399 live websites (38% of ATS install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 15 versions ( 60% of all versions) |
Common Weakness Enumeration
CWE-918 Server-Side Request Forgery (SSRF)Details
- Published - Jul 29, 2026
- Updated - Jul 29, 2026
Credits
- Omkhar Arasaratnam (reporter)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2026-58189 United States | 40 websites |
 Germany | 131 websites |
 China | 128 websites |
 GB | 37 websites |
 France | 11 websites |
 Russia | 11 websites |
 Isle of Man | 8 websites |
 Canada | 5 websites |
 Spain | 5 websites |
 Finland | 5 websites |
Website Distribution by TLD
Number of websites using CVE-2026-58189| .com.cn | 91 websites |
| .com | 66 websites |
| .org | 29 websites |
| .cn | 23 websites |
| .de | 20 websites |
| .ru | 11 websites |
| .org.uk | 11 websites |
| .net | 10 websites |
| .it | 8 websites |
| .fi | 8 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2026-58189
Top websites that are affected by CVE-2026-58189. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ****.******.jp |  Japan | **,*** | |
| ***.**********.de | Germany | **,*** | |
| ******.***.cn | China | **,*** | |
| *********.******.***.cn | China | **,*** | |
| ******.**********.de | Germany | ***,*** | |
| ******.***.cn | China | ***,*** | |
| *****.******.***.cn | China | ***,*** | |
| ***.***.**.uk | GB | ***,*** | |
| ****.******.***.cn | China | ***,*** | |
| *****.****.******.community | Germany | ***,*** |
FAQ
CVE-2026-58189 is Server-Side Request Forgery (SSRF) in ATS
A total of 399 websites have been identified as vulnerable to CVE-2026-58189, based on global website indexing conducted by WebTechSurvey.
The ATS is affected by the CVE-2026-58189 vulnerability.
ATS versions up to and including 10.1.3 are vulnerable to CVE-2026-58189.