CVE-2026-41566

Apache Kvrocks: Improper permission for the APPLYBATCH command

Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: 2.8.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Kvrocks

CVE-2026-54226

Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS

A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Kvrocks

CVE-2026-46751

Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.

A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Kvrocks

CVE-2026-45188

Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling

Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Kvrocks

CVE-2026-47341

Apache APISIX: Session replay issue in hmac-auth

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2022-36124

Memory overconsumption in Avro Rust SDK

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Apache

Products

Avro

CVE-2026-49872

Apache APISIX: Improper authentication in cas-auth plugin

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-49871

Apache APISIX: cas-auth login CSRF / session injection issue

Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity. Actions the victim takes upstream are then attributed to attackers identity. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Apisix Apache Apisix

CVE-2026-48895

Apache APISIX: Cas-auth Host header influence on CAS service URL

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-49231

Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-49230

Apache APISIX: Authentication bypass in jwe-decrypt

Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass.  This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-44087

Apache APISIX: Openid-connect plugin Identity Header Spoofing

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-47339

Apache APISIX: authz-casdoor incorrect session sharing

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-44046

Apache APISIX: wolf-rbac plugin Identity Spoofing

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-39999

Apache APISIX: JWT Algorithm Confusion allows authentication bypass

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0. Users are recommended to upgrade to version v3.17.0, which fixes the issue.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apache Apisix Apisix

CVE-2026-44915

Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-39998

Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apache Apisix Apisix

CVE-2026-54665

Apache NiFi: Missing Validation for Proxy Host Headers

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in the HTTP Host header, but did not apply the validation to alternative Proxy and Forwarded headers. The absence of proxy host header validation allowed a client to instruct Apache NiFi web services to construct invalid qualified URLs for redirection or data references. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which implements validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers based on the nifi.web.proxy.host property. Enabling header validation requires configuring the application with HTTPS. Reverse proxy servers in front of Apache NiFi are responsible for filtering input request headers and providing allowed values to the application.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Nifi

CVE-2025-62198

Apache Atlas: Stored XSS in Create Entity page

An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes the issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Atlas

CVE-2025-66336

Apache Doris MCP Server: SQL injection leading the authentication bypass

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Doris Mcp Server