Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 43

Export CSV
CVE-2026-124726

Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-124723

Apache APISIX: unauthorized access to mTLS protected resources

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-124719

Apache APISIX: identity spoofing in openapi-to-mcp

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-124716

Apache APISIX: authz-keycloak authorization scope mismatch

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-124680

Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. This issue affects Apache APISIX: from 0.9 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-124679

Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-124666

Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator. This issue affects Apache APISIX: from 3.8.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS n/a KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Apisix Apisix Apache Apisix
CVE-2026-94212

Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-78242

Apache APISIX: data-mask may fail to redact request headers in logger output

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure.  This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-94276

Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue affects Apache APISIX: from 3.12.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-94269

Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-94220

Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-75020

Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects Apache APISIX: from 2.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-74848

Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-75005

Apache APISIX: Unauthenticated CPU-exhaustion DoS

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-63041

Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache APISIX: from 3.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2026-47341

Apache APISIX: Session replay issue in hmac-auth

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-49872

Apache APISIX: Improper authentication in cas-auth plugin

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-49871

Apache APISIX: cas-auth login CSRF / session injection issue

Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity. Actions the victim takes upstream are then attributed to attackers identity. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apisix Apache Apisix