Apache Software Foundation Apache Apisix vulnerabilities

CVE-2025-62232 [HIGH] CWE-532 CVE-2025-62232: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to

CVE-2026-31923 [HIGH] CWE-319 CVE-2026-31923: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVE-2026-94212 [MEDIUM] CWE-347 CVE-2026-94212: Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthentica Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue

CVE-2026-94269 [MEDIUM] CWE-647 CVE-2026-94269: Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In som Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unaut

CVE-2024-32638 [MEDIUM] CWE-444 CVE-2024-32638: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APIS Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

CVE-2026-49231 [MEDIUM] CWE-290 CVE-2026-49231: Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed iden Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to

CVE-2026-44046 [MEDIUM] CWE-348 CVE-2026-44046: Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.

CVE-2026-82806 [MEDIUM] CWE-488 CVE-2026-82806: Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apac Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisi

CVE-2026-94276 [MEDIUM] CWE-287 CVE-2026-94276: Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue affects Apache APISIX: from 3.12.0 through 3.18.0. User

CVE-2026-44915 [MEDIUM] CWE-601 CVE-2026-44915: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default con URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2025-46647 [MEDIUM] CWE-302 CVE-2025-46647: A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an imp A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the openid-connect plugin with introspection mode 2. The auth service connected to openid-connect provides services to multiple issuers 3. Multiple issuers share the same private key and relies onl

CVE-2026-31924 [MEDIUM] CWE-319 CVE-2026-31924: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls l Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVE-2026-78242 [MEDIUM] CWE-532 CVE-2026-78242: Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerabili Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVE-2026-94220 [LOW] CWE-352 CVE-2026-94220: Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache A Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including up