Apache Apisix vulnerabilities

• apache apisix Apache APISIX: Cross-user response poisoning in serverless plugins CVE-2026-74848 Fix available 7.0 HighAugust 27, 2026
• apache apisix Apache APISIX: Unauthenticated CPU-exhaustion DoS CVE-2026-75005 Fix available 8.7 HighAugust 27, 2026
• apache apisix Apache APISIX: ldap-auth plugin cross-subtree identity impersonation CVE-2026-75020 Fix available 7.0 HighAugust 27, 2026
• apache apisix Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers CVE-2026-63041 Fix available 5.3 MediumAugust 26, 2026
• apache apisix Apache APISIX: Improper authentication in cas-auth plugin CVE-2026-49872 Fix available 5.3 MediumJune 19, 2026
• apache apisix Apache APISIX: cas-auth login CSRF / session injection issue CVE-2026-49871 Fix available 2.1 LowJune 19, 2026
• apache apisix Apache APISIX: Session replay issue in hmac-auth CVE-2026-47341 Fix available 6.3 MediumJune 19, 2026
• apache apisix Apache APISIX: Cas-auth Host header influence on CAS service URL CVE-2026-48895 Fix available 2.1 LowJune 19, 2026
• apache apisix Apache APISIX: Identity spoofing issue in APISIX opa plugin CVE-2026-49231 Fix available 2.3 LowJune 19, 2026
• apache apisix Apache APISIX: Authentication bypass in jwe-decrypt CVE-2026-49230 Public exploitFix available 6.3 MediumJune 19, 2026
• apache apisix Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value CVE-2026-44915 Fix available 2.1 LowJune 19, 2026
• apache apisix Apache APISIX: Openid-connect plugin Identity Header Spoofing CVE-2026-44087 Fix available 5.3 MediumJune 19, 2026
• apache apisix Apache APISIX: authz-casdoor incorrect session sharing CVE-2026-47339 Fix available 5.3 MediumJune 19, 2026
• apache apisix Apache APISIX: wolf-rbac plugin Identity Spoofing CVE-2026-44046 Fix available 2.3 LowJune 19, 2026
• apache apisix Apache APISIX: JWT Algorithm Confusion allows authentication bypass CVE-2026-39999 Fix available 7.0 HighJune 19, 2026
• apache apisix Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup CVE-2026-39998 Fix available 5.8 MediumJune 19, 2026
• apache apisix Apache APISIX: Openid-connect `tls_verify` field is disabled by default CVE-2026-31923 Fix available 7.5 HighApril 14, 2026
• apache apisix Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP CVE-2026-31924 Fix available 5.3 MediumApril 14, 2026
• apache apisix Apache APISIX: forward auth plugin allows header injection CVE-2026-31908 Public exploitFix available 9.1 CriticalApril 14, 2026
• apache apisix Apache APISIX: basic-auth logs plaintext credentials at info level CVE-2025-62232 Fix available 7.5 HighOctober 31, 2025
• apache apisix, apache software foundation apisix java plugin runner +1 more Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges CVE-2025-27446 Fix available 7.8 HighJuly 6, 2025
• apache apisix Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect CVE-2025-46647 Fix available 5.3 MediumJuly 2, 2025
• apache apisix Apache APISIX: Forward-Auth Request Smuggling CVE-2024-32638 Fix available 6.3 MediumMay 2, 2024
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• apache apisix apisix/jwt-auth may leak secrets in error response CVE-2022-29266 Fix available 7.5 HighApril 20, 2022
• apache apisix Apache APISIX: the body_schema check in request-validation plugin can be bypassed CVE-2022-25757 Fix available 9.8 CriticalMarch 28, 2022
• apache apisix apisix/batch-requests plugin allows overwriting the X-REAL-IP header CVE-2022-24112 In KEVPublic exploitFix available EPSS 96.1% 9.8 CriticalFebruary 11, 2022
• apache apisix dashboard security vulnerability on unauthorized access. CVE-2021-45232 Public exploitFix available EPSS 86.3% 9.8 CriticalDecember 27, 2021
• apache apisix Path traversal in request_uri variable CVE-2021-43557 Public exploitFix available EPSS 13.0% 7.5 HighNovember 22, 2021
• apache apisix dashboard Bypass network access control CVE-2021-33190 Fix available 5.3 MediumJune 8, 2021
• apache apisix In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction... CVE-2020-13945 Public exploitFix available EPSS 73.6% 6.5 MediumDecember 7, 2020