Apache Apisix vulnerabilities

CVE-2022-24112 [CRITICAL] CWE-290 CVE-2022-24112: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Adm An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But the

CVE-2023-44487 [HIGH] CWE-400 CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancell The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2020-13945 [MEDIUM] CVE-2020-13945: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rul In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

CVE-2026-39999 [CRITICAL] CWE-290 CVE-2026-39999: Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypas Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0. Users are recommended to upgrade to version v3.17.0, which fixes the issue.

CVE-2026-49230 [CRITICAL] CWE-354 CVE-2026-49230: Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-31908 [CRITICAL] CWE-75 CVE-2026-31908: Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configu Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVE-2026-44087 [CRITICAL] CWE-345 CVE-2026-44087: Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect p Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0. Users are

CVE-2022-25757 [CRITICAL] CWE-20 CVE-2022-25757: In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the la In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. For example, `{"string_payload":"bad","string_payload":"good"}` can be used to hide the "bad

CVE-2026-63041 [HIGH] CWE-807 CVE-2026-63041: Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerabil Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache APISIX: from 3.11.0 through 3.17.0. Users are recom

CVE-2026-39998 [HIGH] CWE-20 CVE-2026-39998: Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certai Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49872 [HIGH] CWE-287 CVE-2026-49872: Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2021-43557 [HIGH] CWE-77 CVE-2021-43557: The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $req The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypas

CVE-2026-75020 [HIGH] CWE-90 CVE-2026-75020: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects A

CVE-2026-47339 [HIGH] CWE-863 CVE-2026-47339: Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49871 [CRITICAL] CWE-352 CVE-2026-49871: Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity. Actions the victim takes upstream are then attributed to attackers

CVE-2026-74848 [HIGH] CWE-444 CVE-2026-74848: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Ap Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which

CVE-2022-29266 [HIGH] CWE-209 CVE-2022-29266: In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secre In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

CVE-2026-75005 [HIGH] CWE-407 CVE-2026-75005: Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVE-2026-48895 [HIGH] CWE-601 CVE-2026-48895: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker co URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-47341 [MEDIUM] CWE-294 CVE-2026-47341: Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from c Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.