Advisories · Technology

Apache Software Foundation Apache APISIX.

Every CVE that names Apache Software Foundation Apache APISIX among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-94276 CVE record

CVSS 5.1 Medium

Apache APISIX: Openid-connect introspection validation issue
- Apache Software Foundation Apache APISIX
- Authentication bypass
Not analysed yet 1 Oct 2026
CVE-2026-94269 CVE record

CVSS 6.3 Medium

Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch
- Apache Software Foundation Apache APISIX
- CWE-647
Not analysed yet 1 Oct 2026
CVE-2026-94250 CVE record

CVSS 8.2 High

Apache APISIX: Batch response aggregation can exhaust worker memory
- Apache Software Foundation Apache APISIX
- Denial of service
Not analysed yet 1 Oct 2026
CVE-2026-94220 CVE record

CVSS 2.1 Low

Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
- Apache Software Foundation Apache APISIX
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-94212 CVE record

CVSS 6.4 Medium

Apache APISIX: unauthenticated impersonation issue in saml-auth
- Apache Software Foundation Apache APISIX
- Weak cryptography or TLS
Not analysed yet 1 Oct 2026
CVE-2026-82806 CVE record

CVSS 5.3 Medium

Apache APISIX: cross-request permission pollution via static permission list mutation
- Apache Software Foundation Apache APISIX
- CWE-488
Not analysed yet 1 Oct 2026
CVE-2026-78242 CVE record

CVSS 5.7 Medium

Apache APISIX: data-mask may fail to redact request headers in logger output
- Apache Software Foundation Apache APISIX
- Information disclosure
Not analysed yet 1 Oct 2026
CVE-2026-74848 CVE record

CVSS 7.0 High

Apache APISIX: Cross-user response poisoning in serverless plugins
- Apache Software Foundation Apache APISIX
- HTTP request smuggling
Not analysed yet 27 Aug 2026
CVE-2026-75005 CVE record

CVSS 8.7 High

Apache APISIX: Unauthenticated CPU-exhaustion DoS
- Apache Software Foundation Apache APISIX
- Denial of service
Not analysed yet 27 Aug 2026
CVE-2026-75020 CVE record

CVSS 7.0 High

Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
- Apache Software Foundation Apache APISIX
- Other injection
Not analysed yet 27 Aug 2026
CVE-2026-63041 CVE record

CVSS 5.3 Medium

Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
- Apache Software Foundation Apache APISIX
- CWE-807
Not analysed yet 26 Aug 2026
CVE-2026-49872 CVE record

CVSS 5.3 Medium

Apache APISIX: Improper authentication in cas-auth plugin
- Apache Software Foundation Apache APISIX
- Authentication bypass
Not analysed yet 19 Jun 2026
CVE-2026-49871 CVE record

CVSS 2.1 Low

Apache APISIX: cas-auth login CSRF / session injection issue
- Apache Software Foundation Apache APISIX
- Cross-site request forgery (CSRF)
Not analysed yet 19 Jun 2026
CVE-2026-47341 CVE record

CVSS 6.3 Medium

Apache APISIX: Session replay issue in hmac-auth
- Apache Software Foundation Apache APISIX
- Authentication bypass
Not analysed yet 19 Jun 2026
CVE-2026-48895 CVE record

CVSS 2.1 Low

Apache APISIX: Cas-auth Host header influence on CAS service URL
- Apache Software Foundation Apache APISIX
- Open redirect
Not analysed yet 19 Jun 2026
CVE-2026-49231 CVE record

CVSS 2.3 Low

Apache APISIX: Identity spoofing issue in APISIX opa plugin
- Apache Software Foundation Apache APISIX
- Authentication bypass
Not analysed yet 19 Jun 2026
CVE-2026-49230 CVE record

CVSS 6.3 Medium

Apache APISIX: Authentication bypass in jwe-decrypt
- Apache Software Foundation Apache APISIX
- CWE-354
Not analysed yet 19 Jun 2026
CVE-2026-44915 CVE record

CVSS 2.1 Low

Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
- Apache Software Foundation Apache APISIX
- Open redirect
Not analysed yet 19 Jun 2026
CVE-2026-44087 CVE record

CVSS 5.3 Medium

Apache APISIX: Openid-connect plugin Identity Header Spoofing
- Apache Software Foundation Apache APISIX
- CWE-345
Not analysed yet 19 Jun 2026
CVE-2026-47339 CVE record

CVSS 5.3 Medium

Apache APISIX: authz-casdoor incorrect session sharing
- Apache Software Foundation Apache APISIX
- Broken access control
Not analysed yet 19 Jun 2026
CVE-2026-44046 CVE record

CVSS 2.3 Low

Apache APISIX: wolf-rbac plugin Identity Spoofing
- Apache Software Foundation Apache APISIX
- CWE-348
Not analysed yet 19 Jun 2026
CVE-2026-39999 CVE record

CVSS 7.0 High

Apache APISIX: JWT Algorithm Confusion allows authentication bypass
- Apache Software Foundation Apache APISIX
- Authentication bypass
Not analysed yet 19 Jun 2026
CVE-2026-39998 CVE record

CVSS 5.8 Medium

Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup
- Apache Software Foundation Apache APISIX
- CWE-20
Not analysed yet 19 Jun 2026
CVE-2026-31923 CVE record

CVSS 7.5 High

Apache APISIX: Openid-connect `tls_verify` field is disabled by default
- Apache Software Foundation Apache APISIX
- Weak cryptography or TLS
Not analysed yet 14 Apr 2026
CVE-2026-31924 CVE record

CVSS 5.3 Medium

Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
- Apache Software Foundation Apache APISIX
- Weak cryptography or TLS
Not analysed yet 14 Apr 2026
CVE-2026-31908 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache APISIX: forward auth plugin allows header injection
- Apache Software Foundation Apache APISIX
- CWE-75
Not analysed yet 14 Apr 2026
CVE-2025-62232 CVE record

CVSS 7.5 High

Apache APISIX: basic-auth logs plaintext credentials at info level
- Apache Software Foundation Apache APISIX
- Information disclosure
Not analysed yet 31 Oct 2025
CVE-2025-46647 CVE record

CVSS 5.3 Medium

Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect
- Apache Software Foundation Apache APISIX
- CWE-302
Not analysed yet 2 Jul 2025
CVE-2024-32638 CVE record

CVSS 6.3 Medium

Apache APISIX: Forward-Auth Request Smuggling
- Apache Software Foundation Apache APISIX
- HTTP request smuggling
Not analysed yet 2 May 2024
CVE-2022-29266 CVE record

apisix/jwt-auth may leak secrets in error response
- Apache Software Foundation Apache APISIX
- Information disclosure
Not analysed yet 20 Apr 2022
CVE-2022-25757 CVE record

Apache APISIX: the body_schema check in request-validation plugin can be bypassed
- Apache Software Foundation Apache APISIX
- CWE-20
Not analysed yet 28 Mar 2022
CVE-2022-24112 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

apisix/batch-requests plugin allows overwriting the X-REAL-IP header
- Apache Software Foundation Apache APISIX
- Authentication bypass
Not analysed yet 11 Feb 2022
CVE-2021-43557 CVE record

Path traversal in request_uri variable
- Apache Software Foundation Apache APISIX
Not analysed yet 22 Nov 2021
CVE-2020-13945 CVE record

Apache Software Foundation Apache APISIX: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP…
- Apache Software Foundation Apache APISIX
Not analysed yet 7 Dec 2020