What’s Vulnerable › Vulnerabilities

CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-01
• Weakness: CWE-488

Description

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.

Affected products

• Apache Software Foundation Apache APISIX: from 2.3.0 before 3.7.0 — fixed in 3.7.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache APISIX 3.7.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread.html/wvkv2b4oy2fh9v79d30gtsy0bhqmzcdd
• http://www.openwall.com/lists/oss-security/2026/10/01/3

Get alerted when CVE-2026-82806 or the next vulnerability affects your stack