# Apache Software Foundation Apache APISIX.

Every CVE that names Apache Software Foundation Apache APISIX among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache APISIX: Openid-connect introspection validation issue](https://agentprime.io/advisories/CVE-2026-94276.md)
  `CVE-2026-94276` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Authentication bypass
- [Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch](https://agentprime.io/advisories/CVE-2026-94269.md)
  `CVE-2026-94269` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-647
- [Apache APISIX: Batch response aggregation can exhaust worker memory](https://agentprime.io/advisories/CVE-2026-94250.md)
  `CVE-2026-94250` · CVE record: Apache Software Foundation Apache APISIX · CVSS 8.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Denial of service
- [Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin](https://agentprime.io/advisories/CVE-2026-94220.md)
  `CVE-2026-94220` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.1 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache APISIX: unauthenticated impersonation issue in saml-auth](https://agentprime.io/advisories/CVE-2026-94212.md)
  `CVE-2026-94212` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Apache APISIX: cross-request permission pollution via static permission list mutation](https://agentprime.io/advisories/CVE-2026-82806.md)
  `CVE-2026-82806` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-488
- [Apache APISIX: data-mask may fail to redact request headers in logger output](https://agentprime.io/advisories/CVE-2026-78242.md)
  `CVE-2026-78242` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.7 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure
- [Apache APISIX: Cross-user response poisoning in serverless plugins](https://agentprime.io/advisories/CVE-2026-74848.md)
  `CVE-2026-74848` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.0 High · Not analysed yet · Published 27 Aug 2026 · Tags: HTTP request smuggling
- [Apache APISIX: Unauthenticated CPU-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-75005.md)
  `CVE-2026-75005` · CVE record: Apache Software Foundation Apache APISIX · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service
- [Apache APISIX: ldap-auth plugin cross-subtree identity impersonation](https://agentprime.io/advisories/CVE-2026-75020.md)
  `CVE-2026-75020` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.0 High · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection
- [Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers](https://agentprime.io/advisories/CVE-2026-63041.md)
  `CVE-2026-63041` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-807
- [Apache APISIX: Improper authentication in cas-auth plugin](https://agentprime.io/advisories/CVE-2026-49872.md)
  `CVE-2026-49872` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass
- [Apache APISIX: cas-auth login CSRF / session injection issue](https://agentprime.io/advisories/CVE-2026-49871.md)
  `CVE-2026-49871` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache APISIX: Session replay issue in hmac-auth](https://agentprime.io/advisories/CVE-2026-47341.md)
  `CVE-2026-47341` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass
- [Apache APISIX: Cas-auth Host header influence on CAS service URL](https://agentprime.io/advisories/CVE-2026-48895.md)
  `CVE-2026-48895` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Open redirect
- [Apache APISIX: Identity spoofing issue in APISIX opa plugin](https://agentprime.io/advisories/CVE-2026-49231.md)
  `CVE-2026-49231` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.3 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass
- [Apache APISIX: Authentication bypass in jwe-decrypt](https://agentprime.io/advisories/CVE-2026-49230.md)
  `CVE-2026-49230` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-354
- [Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value](https://agentprime.io/advisories/CVE-2026-44915.md)
  `CVE-2026-44915` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Open redirect
- [Apache APISIX: Openid-connect plugin Identity Header Spoofing](https://agentprime.io/advisories/CVE-2026-44087.md)
  `CVE-2026-44087` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345
- [Apache APISIX: authz-casdoor incorrect session sharing](https://agentprime.io/advisories/CVE-2026-47339.md)
  `CVE-2026-47339` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Broken access control
- [Apache APISIX: wolf-rbac plugin Identity Spoofing](https://agentprime.io/advisories/CVE-2026-44046.md)
  `CVE-2026-44046` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.3 Low · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-348
- [Apache APISIX: JWT Algorithm Confusion allows authentication bypass](https://agentprime.io/advisories/CVE-2026-39999.md)
  `CVE-2026-39999` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.0 High · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass
- [Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup](https://agentprime.io/advisories/CVE-2026-39998.md)
  `CVE-2026-39998` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.8 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-20
- [Apache APISIX: Openid-connect \`tls_verify\` field is disabled by default](https://agentprime.io/advisories/CVE-2026-31923.md)
  `CVE-2026-31923` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP](https://agentprime.io/advisories/CVE-2026-31924.md)
  `CVE-2026-31924` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache APISIX: forward auth plugin allows header injection](https://agentprime.io/advisories/CVE-2026-31908.md)
  `CVE-2026-31908` · CVE record: Apache Software Foundation Apache APISIX · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-75
- [Apache APISIX: basic-auth logs plaintext credentials at info level](https://agentprime.io/advisories/CVE-2025-62232.md)
  `CVE-2025-62232` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2025 · Tags: Information disclosure
- [Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect](https://agentprime.io/advisories/CVE-2025-46647.md)
  `CVE-2025-46647` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2025 · Tags: CWE-302
- [Apache APISIX: Forward-Auth Request Smuggling](https://agentprime.io/advisories/CVE-2024-32638.md)
  `CVE-2024-32638` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.3 Medium · Not analysed yet · Published 2 May 2024 · Tags: HTTP request smuggling
- [apisix/jwt-auth may leak secrets in error response](https://agentprime.io/advisories/CVE-2022-29266.md)
  `CVE-2022-29266` · CVE record: Apache Software Foundation Apache APISIX · No CVSS score · Not analysed yet · Published 20 Apr 2022 · Tags: Information disclosure
- [Apache APISIX: the body_schema check in request-validation plugin can be bypassed](https://agentprime.io/advisories/CVE-2022-25757.md)
  `CVE-2022-25757` · CVE record: Apache Software Foundation Apache APISIX · No CVSS score · Not analysed yet · Published 28 Mar 2022 · Tags: CWE-20
- [apisix/batch-requests plugin allows overwriting the X-REAL-IP header](https://agentprime.io/advisories/CVE-2022-24112.md)
  `CVE-2022-24112` · CVE record: Apache Software Foundation Apache APISIX · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.96 · Not analysed yet · Published 11 Feb 2022 · Tags: Authentication bypass
- [Path traversal in request_uri variable](https://agentprime.io/advisories/CVE-2021-43557.md)
  `CVE-2021-43557` · CVE record: Apache Software Foundation Apache APISIX · No CVSS score · EPSS 0.13 · Not analysed yet · Published 22 Nov 2021
- [Apache Software Foundation Apache APISIX: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP…](https://agentprime.io/advisories/CVE-2020-13945.md)
  `CVE-2020-13945` · CVE record: Apache Software Foundation Apache APISIX · No CVSS score · EPSS 0.74 · Not analysed yet · Published 7 Dec 2020

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-apisix>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-apisix/>. Everything for agents: <https://agentprime.io/llms.txt>.