Apache Apisix (Apache Software Foundation) - vulnerabilities (CVEs)

34 CVEs, 7 in the last 30 days, 8 known versions, newest CVE from 2026-10-01. Vendor: Apache Software Foundation.

CVEs of Apache Apisix

• CVE-2026-94276 - CVSS 5.1 (medium), 2026-10-01: Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that…
• CVE-2026-94269 - CVSS 6.3 (medium), 2026-10-01: Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a…
• CVE-2026-94250 - CVSS 8.2 (high), 2026-10-01: Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway…
• CVE-2026-94220 - CVSS 2.1 (low), 2026-10-01: Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted…
• CVE-2026-94212 - CVSS 6.4 (medium), 2026-10-01: Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route…
• CVE-2026-82806 - CVSS 5.3 (medium), 2026-10-01: Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported…
• CVE-2026-78242 - CVSS 5.7 (medium), 2026-10-01: Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the…
• CVE-2026-74848 - CVSS 7.5 (high), 2026-08-27: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive…
• CVE-2026-75005 - CVSS 8.7 (high), 2026-08-27: Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in…
• CVE-2026-75020 - CVSS 8.1 (high), 2026-08-27: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for…
• CVE-2026-63041 - CVSS 8.8 (high), 2026-08-26: Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an…
• CVE-2026-49872 - CVSS 8.1 (high), 2026-06-19: Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with…
• CVE-2026-49871 - CVSS 9.3 (critical), 2026-06-19: Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send…
• CVE-2026-47341 - CVSS 6.5 (medium), 2026-06-19: Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token…
• CVE-2026-48895 - CVSS 7.2 (high), 2026-06-19: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an…
• CVE-2026-49231 - CVSS 5.4 (medium), 2026-06-19: Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default…
• CVE-2026-49230 - CVSS 9.1 (critical), 2026-06-19: Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to…
• CVE-2026-44915 - CVSS 6.1 (medium), 2026-06-19: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to…
• CVE-2026-44087 - CVSS 9.1 (critical), 2026-06-19: Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface…
• CVE-2026-47339 - CVSS 8.1 (high), 2026-06-19: Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate…
• CVE-2026-44046 - CVSS 5.8 (medium), 2026-06-19: Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute…
• CVE-2026-39999 - CVSS 9.1 (critical), 2026-06-19: Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of…
• CVE-2026-39998 - CVSS 8.8 (high), 2026-06-19: Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity…
• CVE-2026-31923 - CVSS 7.5 (high), 2026-04-14: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration…
• CVE-2026-31908 - CVSS 9.1 (critical), 2026-04-14: Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.…
• CVE-2026-31924 - CVSS 5.3 (medium), 2026-04-14: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache…
• CVE-2025-62232 - CVSS 7.5 (high), 2025-10-31: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level…
• CVE-2025-46647 - CVSS 5.3 (medium), 2025-07-02: A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the…
• CVE-2024-32638 - CVSS 6.3 (medium), 2024-05-02: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects…
• CVE-2022-29266 - CVSS 7.5 (high), 2022-04-20: In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the…
• CVE-2022-25757 - CVSS 9.8 (critical), 2022-03-28: In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a…
• CVE-2022-24112 - CVSS 9.8 (critical), 2022-02-11: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with…
• CVE-2021-43557 - CVSS 7.5 (high), 2021-11-22: The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without…
• CVE-2020-13945 - CVSS 6.5 (medium), 2020-12-07: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access…