Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Apache APISIX Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-94276`Apache APISIX: Openid-connect introspection validation issue	Exploitation statusNot known exploited	FixYes	Published10/01/2026	SeverityMedium
`CVE-2026-94269`Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch	Exploitation statusNot known exploited	FixYes	Published10/01/2026	SeverityMedium
`CVE-2026-94250`Apache APISIX: Batch response aggregation can exhaust worker memory	Exploitation statusNot known exploited	FixYes	Published10/01/2026	SeverityHigh
`CVE-2026-94220`Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin	Exploitation statusNot known exploited	FixYes	Published10/01/2026	SeverityLow
`CVE-2026-94212`Apache APISIX: unauthenticated impersonation issue in saml-auth	Exploitation statusNot known exploited	FixYes	Published10/01/2026	SeverityMedium
`CVE-2026-82806`Apache APISIX: cross-request permission pollution via static permission list mutation	Exploitation statusNot known exploited	FixYes	Published10/01/2026	SeverityMedium
`CVE-2026-78242`Apache APISIX: data-mask may fail to redact request headers in logger output	Exploitation statusNot known exploited	FixNot confirmed	Published10/01/2026	SeverityMedium
`CVE-2026-74848`Apache APISIX: Cross-user response poisoning in serverless plugins	Exploitation statusNot known exploited	FixYes	Published08/27/2026	SeverityHigh
`CVE-2026-75005`Apache APISIX: Unauthenticated CPU-exhaustion DoS	Exploitation statusNot known exploited	FixNot confirmed	Published08/27/2026	SeverityHigh
`CVE-2026-75020`Apache APISIX: ldap-auth plugin cross-subtree identity impersonation	Exploitation statusNot known exploited	FixYes	Published08/27/2026	SeverityHigh
`CVE-2026-63041`Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers	Exploitation statusNot known exploited	FixYes	Published08/26/2026	SeverityMedium
`CVE-2026-49872`Apache APISIX: Improper authentication in cas-auth plugin	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityMedium
`CVE-2026-49871`Apache APISIX: cas-auth login CSRF / session injection issue	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityLow
`CVE-2026-47341`Apache APISIX: Session replay issue in hmac-auth	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityMedium
`CVE-2026-48895`Apache APISIX: Cas-auth Host header influence on CAS service URL	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityLow
`CVE-2026-49231`Apache APISIX: Identity spoofing issue in APISIX opa plugin	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityLow
`CVE-2026-49230`Apache APISIX: Authentication bypass in jwe-decrypt	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityMedium
`CVE-2026-44915`Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityLow
`CVE-2026-44087`Apache APISIX: Openid-connect plugin Identity Header Spoofing	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityMedium
`CVE-2026-47339`Apache APISIX: authz-casdoor incorrect session sharing	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityMedium
`CVE-2026-44046`Apache APISIX: wolf-rbac plugin Identity Spoofing	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityLow
`CVE-2026-39999`Apache APISIX: JWT Algorithm Confusion allows authentication bypass	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityHigh
`CVE-2026-39998`Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityMedium
`CVE-2026-31923`Apache APISIX: Openid-connect `tls_verify` field is disabled by default	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityHigh
`CVE-2026-31924`Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2026-31908`Apache APISIX: forward auth plugin allows header injection	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityCritical
`CVE-2025-62232`Apache APISIX: basic-auth logs plaintext credentials at info level	Exploitation statusNot known exploited	FixYes	Published10/31/2025	SeverityHigh
`CVE-2025-46647`Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect	Exploitation statusNot known exploited	FixYes	Published07/02/2025	SeverityMedium
`CVE-2024-32638`Apache APISIX: Forward-Auth Request Smuggling	Exploitation statusNot known exploited	FixYes	Published05/02/2024	SeverityMedium
`CVE-2022-29266`apisix/jwt-auth may leak secrets in error response	Exploitation statusNot confirmed	FixNot confirmed	Published04/20/2022	SeverityUnknown
`CVE-2022-25757`Apache APISIX: the body_schema check in request-validation plugin can be bypassed	Exploitation statusNot confirmed	FixNot confirmed	Published03/28/2022	SeverityUnknown
`CVE-2022-24112`apisix/batch-requests plugin allows overwriting the X-REAL-IP header	Exploitation statusKEV	FixYes	Published02/11/2022	SeverityCritical
`CVE-2021-43557`Path traversal in request_uri variable	Exploitation statusNot confirmed	FixYes	Published11/22/2021	SeverityUnknown
`CVE-2020-13945`	Exploitation statusNot confirmed	FixNot confirmed	Published12/07/2020	SeverityUnknown

34 / 34 Results

All vulnerabilities loaded

Security vulnerabilities in Apache APISIX

Apache APISIX

How many security vulnerabilities does Apache APISIX currently have?

Does the latest version of Apache APISIX have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management