Apache Apisix
25 CVEs affecting Apache Apisix. Latest disclosed: 2026-06-19. Critical: 7, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25757 | Critical | 9.8 | 2022-03-28 | In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a d… |
CVE-2022-24112 | Critical | 9.8 | 2022-02-11 | An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with defa… |
CVE-2026-49871 | Critical | 9.3 | 2026-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send… |
CVE-2026-49230 | Critical | 9.1 | 2026-06-19 | Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authenticatio… |
CVE-2026-44087 | Critical | 9.1 | 2026-06-19 | Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface tha… |
CVE-2026-39999 | Critical | 9.1 | 2026-06-19 | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of… |
CVE-2026-31908 | Critical | 9.1 | 2026-04-14 | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. … |
CVE-2026-39998 | High | 8.8 | 2026-06-19 | Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity he… |
CVE-2026-49872 | High | 8.1 | 2026-06-19 | Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credent… |
CVE-2026-47339 | High | 8.1 | 2026-06-19 | Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themsel… |
CVE-2025-27446 | High | 7.8 | 2025-07-06 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin ru… |
CVE-2026-31923 | High | 7.5 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration bein… |
CVE-2025-62232 | High | 7.5 | 2025-10-31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2022-29266 | High | 7.5 | 2022-04-20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependenc… |
CVE-2021-43557 | High | 7.5 | 2021-11-22 | The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normaliza… |
CVE-2026-48895 | High | 7.2 | 2026-06-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redir… |
CVE-2026-47341 | Medium | 6.5 | 2026-06-19 | Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token foreve… |
CVE-2020-13945 | Medium | 6.5 | 2020-12-07 | In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APIS… |
CVE-2024-32638 | Medium | 6.3 | 2024-05-02 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apac… |