Vulnerabilidades do Apache Software Foundation Apisix

CVE-2026-49872 Alta · 8.1 CWE-287 19/06/2026

Apache APISIX: Improper authentication in cas-auth plugin

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49871 Crítica · 9.3 CWE-352 19/06/2026

Vulnerabilidade de CSRF no plugin cas-auth do Apache APISIX (CVE-2026-49871)

Vulnerabilidade de Cross-Site Request Forgery (CSRF) no plugin cas-auth em configurações padrão. Esse defeito permite que um atacante remoto que consiga levar uma vítima a uma página web controlada por ele faça o navegador da vítima ficar autenticado como outra identidade. Ações que a vítima realiza no upstream são então atribuídas à identidade do atacante. Esse problema afeta o Apache APISIX: da versão 3.0.0 até a 3.16.0. Recomenda-se que os usuários atualizem para a versão 3.17.0, que corrige o problema.

CVE-2026-49231 Média · 5.4 CWE-290 19/06/2026

Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-49230 Crítica · 9.1 CWE-354 19/06/2026

Bypass de autenticação no plugin jwe-decrypt do Apache APISIX por validação inadequada de integridade

Validação inadequada de valor de verificação de integridade (Improper Validation of Integrity Check Value) em Apache APISIX. O plugin jwe-decrypt, na configuração padrão, é vulnerável a bypass de autenticação. Este problema afeta o Apache APISIX: da versão 3.8.0 até 3.16.0. Recomenda-se que os usuários atualizem para a versão 3.17.0, que corrige o problema.

CVE-2026-48895 Alta · 7.2 CWE-601 19/06/2026

Apache APISIX: Cas-auth Host header influence on CAS service URL

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-47341 Média · 6.5 CWE-294 19/06/2026

Apache APISIX: Session replay issue in hmac-auth

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-47339 Alta · 8.1 CWE-863 19/06/2026

Apache APISIX: authz-casdoor incorrect session sharing

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-44915 Média · 6.1 CWE-601 19/06/2026

Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-44087 Crítica · 9.1 CWE-345 19/06/2026

Apache APISIX: falha de spoofing de cabeçalhos de identidade no plugin openid-connect (CVE-2026-44087)

Vulnerabilidade de Verificação Insuficiente da Autenticidade de Dados no Apache APISIX. O plugin openid-connect, com configuração padrão, possui uma superfície de ataque que permite ao atacante falsificar cabeçalhos de identidade, possibilitando acesso não autorizado a recursos protegidos. Este problema afeta o Apache APISIX: da versão 2.3 até a 3.16.0. Recomenda-se que os usuários atualizem para a versão 3.17.0, que corrige o problema.

CVE-2026-44046 Média · 5.8 CWE-348 19/06/2026

Apache APISIX: wolf-rbac plugin Identity Spoofing

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-39999 Crítica · 9.1 CWE-290 19/06/2026

Apache APISIX: Bypass de Autenticação por Spoofing no Plugin jwt-auth (CVE-2026-39999)

Vulnerabilidade de Bypass de Autenticação por Spoofing no Apache APISIX. O atacante pode contornar completamente a autenticação explorando determinadas configurações do plugin jwt-auth. Este problema afeta o Apache APISIX: da v2.2 até a v3.16.0. Recomenda-se que os usuários atualizem para a versão v3.17.0, que corrige o problema.

CVE-2026-39998 Alta · 8.8 CWE-20 19/06/2026

Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-31924 Média · 5.3 CWE-319 14/04/2026

Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVE-2026-31923 Alta · 7.5 CWE-319 14/04/2026

Apache APISIX: Openid-connect `tls_verify` field is disabled by default

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVE-2026-31908 Crítica · 9.1 CWE-75 14/04/2026

Apache APISIX: forward auth plugin allows header injection

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVE-2025-62232 Alta · 7.5 CWE-532 31/10/2025

Apache APISIX: basic-auth logs plaintext credentials at info level

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.

CVE-2023-44487 Alta · 7.5 KEV Urgente · 73 Exploit público CWE-400 10/10/2023

HTTP/2 Rapid Reset Attack Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2022-24112 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-290 11/02/2022

Apache APISIX Authentication Bypass Vulnerability

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.