CVE-2026-94269
MediumCVSS 6.3Summary
Apache APISIX versions 2.14.1 through 3.18.0 contain a vulnerability in the use of non-canonical URL paths for authorization decisions. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover, allowing unauthenticated access.
Risk Assessment
Risk includes unauthorized access to protected endpoints, which can lead to confidentiality and integrity breaches.
Recommendation
Upgrade Apache APISIX to version 3.19.0, which fixes the issue.
Other vulnerabilities in Apache APISIX
See all- CVE-2026-94276Medium
Apache APISIX versions 3.12.0 through 3.18.0 contain an improper authentication vulnerability in the openid-connect plugin. A token that is active for one issuer may be accepted on a route restricted to another issuer when remote introspection is used.
- CVE-2026-94250High
The batch-requests plugin in Apache APISIX allows allocation of resources without limits or throttling. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. The issue affects Apache APISIX from 1.3.0 through 3.18.0.
- CVE-2026-94212Medium
Apache APISIX versions 3.17.0 through 3.18.0 contain an improper verification of cryptographic signature vulnerability in the saml-auth plugin. An unauthenticated attacker can impersonate any user on routes protected by this plugin under default configuration.
- CVE-2026-82806Medium
Vulnerability in Apache APISIX exposing data to the wrong session. Under certain authz-keycloak configurations, a request's authorization scope may persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Affects versions from 2.3.0 before 3.7.0.
- CVE-2026-78242Medium
A vulnerability in Apache APISIX 3.17.0 causes unmasked header values to be written to the log sink under a certain response structure. The issue is fixed in version 3.18.0.
- CVE-2026-49230Critical
The vulnerability related to improper validation of integrity check value in Apache APISIX allows authentication bypass in the jwe-decrypt plugin under default configuration. This issue affects versions from 3.8.0 to 3.16.0.
- CVE-2026-39999Critical
Authentication Bypass by Spoofing vulnerability in Apache APISIX allows an attacker to completely bypass the authentication process by capitalizing on certain configurations of the jwt-auth plugin. This issue affects Apache APISIX from v2.2 through v3.16.0.
- CVE-2022-24112CriticalActively exploited
In Apache APISIX, an attacker can abuse the batch-requests plugin to bypass the IP restriction of the Admin API. A default configuration (with default API key) is vulnerable to remote code execution; even after changing the admin key or port, there is still a risk of bypassing the IP restriction of the data panel due to a bug in the client IP check.
- CVE-2026-75020High
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
- CVE-2026-75005High
Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.
Original NVD description (English source)
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS