CVE-2026-75020
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
Risk Assessment
This vulnerability allows unauthorized access to resources protected by APISIX, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade Apache APISIX to version 3.18.0, which fixes this issue.
Other vulnerabilities in Apache APISIX
See all- CVE-2026-49230Critical
The vulnerability related to improper validation of integrity check value in Apache APISIX allows authentication bypass in the jwe-decrypt plugin under default configuration. This issue affects versions from 3.8.0 to 3.16.0.
- CVE-2026-39999Critical
Authentication Bypass by Spoofing vulnerability in Apache APISIX allows an attacker to completely bypass the authentication process by capitalizing on certain configurations of the jwt-auth plugin. This issue affects Apache APISIX from v2.2 through v3.16.0.
- CVE-2026-75005High
Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.
- CVE-2026-74848High
Apache APISIX versions 2.12.0 through 3.17.0 are vulnerable to HTTP Request/Response Smuggling. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.
- CVE-2026-63041High
Apache APISIX has a vulnerability relying on untrusted inputs in a security decision. An attacker can escalate privileges or bypass authorization by sending certain values not properly sanitized by the attach-consumer-label plugin.
- CVE-2026-49872High
CVE-2026-49872 describes an improper authentication vulnerability in Apache APISIX that allows an attacker to authenticate with credentials from a different source when the cas-auth plugin is used in a route. This issue affects versions from 3.0.0 to 3.16.0.
- CVE-2026-47339High
CVE-2026-47339 in Apache APISIX has an incorrect authorization vulnerability that allows an attacker to authenticate using credentials from a different source. This issue affects versions from 2.14.1 through 3.16.0.
- CVE-2026-44915Medium
The 'Open Redirect' vulnerability in Apache APISIX allows redirecting users to untrusted sites, potentially leading to phishing and credential theft. This affects versions from 3.0.0 to 3.16.0.
- CVE-2026-39998High
Improper Input Validation vulnerability in Apache APISIX allows an attacker to spoof identity headers by exploiting certain configuration in the forward-auth plugin. This issue affects versions from 2.12.0 through 3.16.0.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects Apache APISIX: from 2.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.