Actively exploited in the wild
Apache APISIX Authentication Bypass Vulnerability
Apache - APISIX · Listed in the CISA KEV since 2022-08-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-24112
CriticalCVSS 9.8KEVSummary
In Apache APISIX, an attacker can abuse the batch-requests plugin to bypass the IP restriction of the Admin API. A default configuration (with default API key) is vulnerable to remote code execution; even after changing the admin key or port, there is still a risk of bypassing the IP restriction of the data panel due to a bug in the client IP check.
Risk Assessment
An attacker can gain unauthorized access to the administrative API and execute arbitrary code, taking control of the API gateway. Even after changing default settings, the risk of bypassing IP restrictions remains.
Recommendation
Update Apache APISIX to a patched version. Change the default API key, restrict Admin API access to trusted networks, and consider disabling the batch-requests plugin if not needed.
Other vulnerabilities in Apache APISIX
See all- CVE-2026-49230Critical
The vulnerability related to improper validation of integrity check value in Apache APISIX allows authentication bypass in the jwe-decrypt plugin under default configuration. This issue affects versions from 3.8.0 to 3.16.0.
- CVE-2026-39999Critical
Authentication Bypass by Spoofing vulnerability in Apache APISIX allows an attacker to completely bypass the authentication process by capitalizing on certain configurations of the jwt-auth plugin. This issue affects Apache APISIX from v2.2 through v3.16.0.
- CVE-2026-75020High
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
- CVE-2026-75005High
Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.
- CVE-2026-74848High
Apache APISIX versions 2.12.0 through 3.17.0 are vulnerable to HTTP Request/Response Smuggling. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.
- CVE-2026-63041High
Apache APISIX has a vulnerability relying on untrusted inputs in a security decision. An attacker can escalate privileges or bypass authorization by sending certain values not properly sanitized by the attach-consumer-label plugin.
- CVE-2026-49872High
CVE-2026-49872 describes an improper authentication vulnerability in Apache APISIX that allows an attacker to authenticate with credentials from a different source when the cas-auth plugin is used in a route. This issue affects versions from 3.0.0 to 3.16.0.
- CVE-2026-47339High
CVE-2026-47339 in Apache APISIX has an incorrect authorization vulnerability that allows an attacker to authenticate using credentials from a different source. This issue affects versions from 2.14.1 through 3.16.0.
- CVE-2026-44915Medium
The 'Open Redirect' vulnerability in Apache APISIX allows redirecting users to untrusted sites, potentially leading to phishing and credential theft. This affects versions from 3.0.0 to 3.16.0.
- CVE-2026-39998High
Improper Input Validation vulnerability in Apache APISIX allows an attacker to spoof identity headers by exploiting certain configuration in the forward-auth plugin. This issue affects versions from 2.12.0 through 3.16.0.
Original NVD description (English source)
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.