What’s Vulnerable › Products

Apache Software Foundation Apache APISIX vulnerabilities

36 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your Apache Software Foundation Apache APISIX version is affected

Exploited Apache Software Foundation Apache APISIX vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
• CVE-2022-24112 — Apache APISIX Authentication Bypass Vulnerability

Latest Apache Software Foundation Apache APISIX vulnerabilities

• CVE-2026-94276 — Apache APISIX: Openid-connect introspection validation issue (CVSS 5.1)
• CVE-2026-94269 — Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch (CVSS 6.3)
• CVE-2026-94250 — Apache APISIX: Batch response aggregation can exhaust worker memory (CVSS 8.2)
• CVE-2026-94220 — Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin (CVSS 2.1)
• CVE-2026-94212 — Apache APISIX: unauthenticated impersonation issue in saml-auth (CVSS 6.4)
• CVE-2026-82806 — Apache APISIX: cross-request permission pollution via static permission list mutation (CVSS 5.3)
• CVE-2026-78242 — Apache APISIX: data-mask may fail to redact request headers in logger output (CVSS 5.7)
• CVE-2026-75020 — Apache APISIX: ldap-auth plugin cross-subtree identity impersonation (CVSS 8.1)
• CVE-2026-75005 — Apache APISIX: Unauthenticated CPU-exhaustion DoS (CVSS 7.5)
• CVE-2026-74848 — Apache APISIX: Cross-user response poisoning in serverless plugins (CVSS 7.5)
• CVE-2026-63041 — Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers (CVSS 8.8)
• CVE-2026-49872 — Apache APISIX: Improper authentication in cas-auth plugin (CVSS 8.1)
• CVE-2026-49871 — Apache APISIX: cas-auth login CSRF / session injection issue (CVSS 9.3)
• CVE-2026-49231 — Apache APISIX: Identity spoofing issue in APISIX opa plugin (CVSS 5.4)
• CVE-2026-49230 — Apache APISIX: Authentication bypass in jwe-decrypt (CVSS 9.1)
• CVE-2026-48895 — Apache APISIX: Cas-auth Host header influence on CAS service URL (CVSS 7.2)
• CVE-2026-47341 — Apache APISIX: Session replay issue in hmac-auth (CVSS 6.5)
• CVE-2026-47339 — Apache APISIX: authz-casdoor incorrect session sharing (CVSS 8.1)
• CVE-2026-44915 — Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value (CVSS 6.1)
• CVE-2026-44087 — Apache APISIX: Openid-connect plugin Identity Header Spoofing (CVSS 9.1)
• CVE-2026-44046 — Apache APISIX: wolf-rbac plugin Identity Spoofing (CVSS 5.8)
• CVE-2026-39999 — Apache APISIX: JWT Algorithm Confusion allows authentication bypass (CVSS 9.1)
• CVE-2026-39998 — Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup (CVSS 8.8)
• CVE-2026-31924 — Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP (CVSS 5.3)
• CVE-2026-31923 — Apache APISIX: Openid-connect `tls_verify` field is disabled by default (CVSS 7.5)