CVE-2021-42009: Email relay in Apache Traffic Control
Summary
CVE-2021-42009: Email relay in Apache Traffic Control. Affects github.com/apache/trafficcontrol versions < 5.1.3. Fixed in 5.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Traffic Control is an open-source content delivery network (CDN) management system. It provides a set of tools and APIs for managing and monitoring CDN infrastructure. The package 'github.com/apache/trafficcontrol' is a Go implementation of Apache Traffic Control. It is used by administrators to configure and control CDN delivery services. This package is vulnerable to an email relay attack, which allows an authenticated user with Portal-level privileges to send arbitrary emails from the Traffic Ops server to any email address.
Vulnerability Detail
The vulnerability (CVE-2021-42009) in Apache Traffic Control allows an authenticated user with Portal-level privileges to send specially-crafted requests to the '/deliveryservices/request' endpoint in Traffic Ops. By manipulating the email subject, the attacker can send an email with an arbitrary body to any email address from the Traffic Ops server. This can be exploited to send spam emails, phishing attempts, or perform other malicious activities. The vulnerability affects Apache Traffic Control versions 4.1.x and 5.1.x. Users of version 5.1.x should upgrade to 5.1.3 or 6.0.0, while users of version 4.1.x should upgrade to 5.1.3.
How To Fix
Latest published version: v7.0.1+incompatible as of 23 Oct 2026
go get github.com/apache/trafficcontrol@v7.0.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.3
This is the first release that contains the fix.
go get github.com/apache/trafficcontrol@v5.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the patched versions of Apache Traffic Control.
Conclusion
The vulnerability in Apache Traffic Control allows an authenticated user to send arbitrary emails from the Traffic Ops server. To mitigate this issue, it is crucial to upgrade to the patched versions of Apache Traffic Control. Users of version 5.1.x should upgrade to 5.1.3 or 6.0.0, while users of version 4.1.x should upgrade to 5.1.3. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/apache/trafficcontrol →
FAQ
Apache Traffic Control is an open-source content delivery network (CDN) management system. It provides tools and APIs for managing and monitoring CDN infrastructure.
The vulnerability allows an authenticated user to send arbitrary emails from the Traffic Ops server. This can be exploited for spamming, phishing, or other malicious activities.
The vulnerability affects versions 4.1.x and 5.1.x of Apache Traffic Control.
Users of version 5.1.x should upgrade to 5.1.3 or 6.0.0. Users of version 4.1.x should upgrade to 5.1.3. Follow the official upgrade instructions provided by Apache Traffic Control.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the recommended fix by upgrading to the patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/trafficcontrol.
