Varnish HTTP Cache Vulnerability Allows Security Bypass

CERT-Bund has released security advisory WID-SEC-2026-0749 detailing a critical vulnerability in multiple versions of Varnish HTTP Cache. The flaw, rated with a CVSS base score of 6.5, enables remote, anonymous attackers to bypass implemented security measures. Affected versions include Varnish HTTP Cache <8.0.1, <9.0 (Vinyl Cache), <6.0.17, and <6.0.16r12, running on Linux and UNIX operating systems.

Organizations utilizing the affected Varnish HTTP Cache versions must take immediate action to mitigate this risk. While specific mitigation steps are not detailed in this advisory, users are strongly advised to update to patched versions or implement alternative security controls. Failure to address this vulnerability could lead to unauthorized access or compromise of systems protected by Varnish, potentially impacting data integrity and availability.