CVE-2026-63041
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Apache APISIX has a vulnerability relying on untrusted inputs in a security decision. An attacker can escalate privileges or bypass authorization by sending certain values not properly sanitized by the attach-consumer-label plugin.
Risk Assessment
The vulnerability allows unauthorized access or privilege escalation, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade Apache APISIX to version 3.18.0, which fixes the issue.
Other vulnerabilities in Apache APISIX
See all- CVE-2026-49230Critical
The vulnerability related to improper validation of integrity check value in Apache APISIX allows authentication bypass in the jwe-decrypt plugin under default configuration. This issue affects versions from 3.8.0 to 3.16.0.
- CVE-2026-39999Critical
Authentication Bypass by Spoofing vulnerability in Apache APISIX allows an attacker to completely bypass the authentication process by capitalizing on certain configurations of the jwt-auth plugin. This issue affects Apache APISIX from v2.2 through v3.16.0.
- CVE-2026-75020High
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
- CVE-2026-75005High
Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.
- CVE-2026-74848High
Apache APISIX versions 2.12.0 through 3.17.0 are vulnerable to HTTP Request/Response Smuggling. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.
- CVE-2026-49872High
CVE-2026-49872 describes an improper authentication vulnerability in Apache APISIX that allows an attacker to authenticate with credentials from a different source when the cas-auth plugin is used in a route. This issue affects versions from 3.0.0 to 3.16.0.
- CVE-2026-47339High
CVE-2026-47339 in Apache APISIX has an incorrect authorization vulnerability that allows an attacker to authenticate using credentials from a different source. This issue affects versions from 2.14.1 through 3.16.0.
- CVE-2026-44915Medium
The 'Open Redirect' vulnerability in Apache APISIX allows redirecting users to untrusted sites, potentially leading to phishing and credential theft. This affects versions from 3.0.0 to 3.16.0.
- CVE-2026-39998High
Improper Input Validation vulnerability in Apache APISIX allows an attacker to spoof identity headers by exploiting certain configuration in the forward-auth plugin. This issue affects versions from 2.12.0 through 3.16.0.
Original NVD description (English source)
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache APISIX: from 3.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.