Apache Apisix

25 CVEs affecting Apache Apisix. Latest disclosed: 2026-06-19. Critical: 7, High: 10.

Top CVEs affecting Apache Apisix
CVESeverityScorePublishedSummary
CVE-2022-25757Critical9.82022-03-28In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a d…
CVE-2022-24112Critical9.82022-02-11An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with defa…
CVE-2026-49871Critical9.32026-06-19Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send…
CVE-2026-49230Critical9.12026-06-19Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authenticatio…
CVE-2026-44087Critical9.12026-06-19Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface tha…
CVE-2026-39999Critical9.12026-06-19Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of…
CVE-2026-31908Critical9.12026-04-14Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. …
CVE-2026-39998High8.82026-06-19Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity he…
CVE-2026-49872High8.12026-06-19Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credent…
CVE-2026-47339High8.12026-06-19Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themsel…
CVE-2025-27446High7.82025-07-06Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin ru…
CVE-2026-31923High7.52026-04-14Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration bein…
CVE-2025-62232High7.52025-10-31Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is…
CVE-2023-44487High7.52023-10-10The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w…
CVE-2022-29266High7.52022-04-20In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependenc…
CVE-2021-43557High7.52021-11-22The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normaliza…
CVE-2026-48895High7.22026-06-19URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redir…
CVE-2026-47341Medium6.52026-06-19Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token foreve…
CVE-2020-13945Medium6.52020-12-07In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APIS…
CVE-2024-32638Medium6.32024-05-02Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apac…