CVE-2026-75020: Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-08-31
Weakness: CWE-90

Description

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects Apache APISIX: from 2.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Affected products

Apache Software Foundation Apache APISIX: from 2.11.0 before 3.18.0 — fixed in 3.18.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache APISIX 3.18.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-75020 or the next vulnerability affects your stack