Apache APISIX
- Software type
- API gateway
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, Apache APISIX recorded 11 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache APISIX and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124726Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declareCVE-2026-124723Apache APISIX: unauthorized access to mTLS protected resourcesCVE-2026-124719Apache APISIX: identity spoofing in openapi-to-mcpCVE-2026-124716Apache APISIX: authz-keycloak authorization scope mismatchCVE-2026-124680Apache Software Foundation Apache APISIX: route-level authorization bypass through path normalization mismatch| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-124726Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-124723Apache APISIX: unauthorized access to mTLS protected resources | Exploitation statusNot exploited | FixYes | Published11/13/2026 | SeverityMedium |
|---|
CVE-2026-124719Apache APISIX: identity spoofing in openapi-to-mcp | Exploitation statusNot exploited | FixYes | Published11/13/2026 | SeverityLow |
|---|
CVE-2026-124716Apache APISIX: authz-keycloak authorization scope mismatch | Exploitation statusNot confirmed | FixYes | Published11/13/2026 | SeverityMedium |
|---|
CVE-2026-124680Apache Software Foundation Apache APISIX: route-level authorization bypass through path normalization mismatch | Exploitation statusNot exploited | FixYes | Published11/13/2026 | SeverityHigh |
|---|
CVE-2026-124679Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header | Exploitation statusNot confirmed | FixYes | Published11/13/2026 | SeverityHigh |
|---|
CVE-2026-124666Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers | Exploitation statusNot confirmed | FixYes | Published11/13/2026 | SeverityMedium |
|---|
CVE-2026-94276Cross-issuer authentication bypass in Apache APISIX | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-94269Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-94250Apache APISIX: Batch response aggregation can exhaust worker memory | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-94220Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityLow |
|---|
CVE-2026-94212Apache APISIX: unauthenticated impersonation issue in saml-auth | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-82806Apache APISIX: cross-request permission pollution via static permission list mutation | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-78242Apache APISIX: data-mask may fail to redact request headers in logger output | Exploitation statusNot exploited | FixNo | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-75020Apache APISIX: ldap-auth plugin cross-subtree identity impersonation | Exploitation statusNot exploited | FixYes | Published08/27/2026 | SeverityHigh |
|---|
CVE-2026-75005Apache APISIX: Unauthenticated CPU-exhaustion DoS | Exploitation statusNot exploited | FixNo | Published08/27/2026 | SeverityHigh |
|---|
CVE-2026-74848Apache APISIX: Cross-user response poisoning in serverless plugins | Exploitation statusNot exploited | FixYes | Published08/27/2026 | SeverityHigh |
|---|
CVE-2026-63041Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers | Exploitation statusNot exploited | FixYes | Published08/26/2026 | SeverityMedium |
|---|
CVE-2026-49872Apache APISIX: Improper authentication in cas-auth plugin | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityMedium |
|---|
CVE-2026-49871Apache APISIX: cas-auth login CSRF / session injection issue | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityLow |
|---|
CVE-2026-49231Apache APISIX: Identity spoofing issue in APISIX opa plugin | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityLow |
|---|
CVE-2026-49230Authentication bypass in Apache Software Foundation's Apache APISIX jwe-decrypt plugin | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityMedium |
|---|
CVE-2026-48895Apache APISIX: Cas-auth Host header influence on CAS service URL | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityLow |
|---|
CVE-2026-47341Apache APISIX: Session replay issue in hmac-auth | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityMedium |
|---|
CVE-2026-47339Apache APISIX: authz-casdoor incorrect session sharing | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityMedium |
|---|
CVE-2026-44915Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityLow |
|---|
CVE-2026-44087Apache APISIX: Openid-connect plugin Identity Header Spoofing | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityMedium |
|---|
CVE-2026-44046Apache APISIX: wolf-rbac plugin Identity Spoofing | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityLow |
|---|
CVE-2026-39999Apache APISIX: JWT Algorithm Confusion allows authentication bypass | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityHigh |
|---|
CVE-2026-39998Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityMedium |
|---|
CVE-2026-31924Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP | Exploitation statusNot exploited | FixYes | Published04/14/2026 | SeverityMedium |
|---|
CVE-2026-31923Apache APISIX: Openid-connect `tls_verify` field is disabled by default | Exploitation statusNot exploited | FixYes | Published04/14/2026 | SeverityHigh |
|---|
CVE-2026-31908Apache Software Foundation Apache APISIX forward-auth plugin permits header injection | Exploitation statusNot exploited | FixYes | Published04/14/2026 | SeverityCritical |
|---|
CVE-2025-62232Apache APISIX: basic-auth logs plaintext credentials at info level | Exploitation statusNot exploited | FixYes | Published10/31/2025 | SeverityHigh |
|---|
CVE-2025-46647Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect | Exploitation statusNot exploited | FixYes | Published07/02/2025 | SeverityMedium |
|---|
CVE-2024-32638Apache APISIX: Forward-Auth Request Smuggling | Exploitation statusNot exploited | FixYes | Published05/02/2024 | SeverityMedium |
|---|
CVE-2022-29266apisix/jwt-auth may leak secrets in error response | Exploitation statusNot confirmed | FixNo | Published04/20/2022 | SeverityUnknown |
|---|
CVE-2022-25757Apache APISIX: the body_schema check in request-validation plugin can be bypassed | Exploitation statusNot confirmed | FixNo | Published03/28/2022 | SeverityUnknown |
|---|
CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP header | Exploitation statusKEV | FixYes | Published02/11/2022 | SeverityCritical |
|---|
CVE-2021-43557Path traversal in request_uri variable | Exploitation statusNot confirmed | FixYes | Published11/22/2021 | SeverityUnknown |
|---|
CVE-2020-13945CVE-2020-13945 | Exploitation statusNot confirmed | FixNo | Published12/07/2020 | SeverityUnknown |
|---|
34 Results | Page 1 of 1