CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter

Overview

A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter (e.g., utm_campaign) and poison the cache. Subsequent visitors receive the poisoned response containing arbitrary JavaScript.

Vulnerability Details

• Type: Web Cache Poisoning
• Impact: Stored XSS, credential theft, defacement.
• Root Cause: The cache key excludes query string parameters that influence the response body, allowing an attacker to store a crafted response that is served to all users.

Exploit Demonstration

1. Start the vulnerable caching server:
   root@kitploit:~

   pip install flask
   python cache_server.py
   

2. Run the exploit: