Apisix (Apache) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 75 known versions, newest CVE from 2026-08-27. Vendor: Apache.

CVEs of Apisix

CVE-2026-74848 - CVSS 7.5 (high), 2026-08-27: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive…
CVE-2026-75005 - CVSS 8.7 (high), 2026-08-27: Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in…
CVE-2026-75020 - CVSS 8.1 (high), 2026-08-27: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for…
CVE-2026-63041 - CVSS 8.8 (high), 2026-08-26: Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an…
CVE-2026-49872 - CVSS 8.1 (high), 2026-06-19: Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with…
CVE-2026-49871 - CVSS 9.3 (critical), 2026-06-19: Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send…
CVE-2026-47341 - CVSS 6.5 (medium), 2026-06-19: Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token…
CVE-2026-48895 - CVSS 7.2 (high), 2026-06-19: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an…
CVE-2026-49231 - CVSS 5.4 (medium), 2026-06-19: Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default…
CVE-2026-49230 - CVSS 9.1 (critical), 2026-06-19: Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to…
CVE-2026-44915 - CVSS 6.1 (medium), 2026-06-19: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to…
CVE-2026-44087 - CVSS 9.1 (critical), 2026-06-19: Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface…
CVE-2026-47339 - CVSS 8.1 (high), 2026-06-19: Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate…
CVE-2026-44046 - CVSS 5.8 (medium), 2026-06-19: Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute…
CVE-2026-39999 - CVSS 9.1 (critical), 2026-06-19: Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of…
CVE-2026-39998 - CVSS 8.8 (high), 2026-06-19: Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity…
CVE-2026-31923 - CVSS 7.5 (high), 2026-04-14: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration…
CVE-2026-31908 - CVSS 9.1 (critical), 2026-04-14: Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.…
CVE-2026-31924 - CVSS 5.3 (medium), 2026-04-14: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache…
CVE-2025-62232 - CVSS 7.5 (high), 2025-10-31: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level…
CVE-2025-27446 - CVSS 7.8 (high), 2025-07-06: Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin…
CVE-2025-46647 - CVSS 5.3 (medium), 2025-07-02: A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the…
CVE-2024-32638 - CVSS 6.3 (medium), 2024-05-02: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2022-29266 - CVSS 7.5 (high), 2022-04-20: In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the…
CVE-2022-25757 - CVSS 9.8 (critical), 2022-03-28: In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a…
CVE-2022-24112 - CVSS 9.8 (critical), 2022-02-11: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with…
CVE-2021-43557 - CVSS 7.5 (high), 2021-11-22: The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without…
CVE-2020-13945 - CVSS 6.5 (medium), 2020-12-07: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access…