PoC-Apisix

PoC-Apisix RCE via serverless-pre-function plugin when Admi...

CVE-2021-33190

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...

The vulnerability of the java-plugin-runner plugin for the Apache APISIX cloud API allows a hacker to escalate their privileges.

The vulnerability of the java-plugin-runner plugin of the Apache APISIX cloud API gateway is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: supercronic, opensearch-k8s-operator, secrets-store-csi-driver, kubernetes-dashboard-web, gitsign, rancher-loglevel, harbor-registry, go-discover, kserve-rest-proxy, restic, go-jsonnet, hydra, gptscript, kube-bench, grafana-alloy, grafana-image-renderer, spire-server...

CVE-2025-62232

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit:...

BIT-APISIX-2025-62232 Apache APISIX: basic-auth logs plaintext credentials at info level

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: ...

CVE-2025-62232

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: ...

CVE-2025-62232 Apache APISIX: basic-auth logs plaintext credentials at info level

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: ...

CVE-2025-62232

The Apache APISIX API gateway contains a sensitive data exposure vulnerability where basic-auth credentials, including plaintext usernames and passwords, are written to error logs. This occurs when the log level is set to INFO or DEBUG , leading to a high risk of credential compromise as these lo...

CVE-2025-62232 Apache APISIX: basic-auth logs plaintext credentials at info level

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: ...

Apache Apisix 安全漏洞

Apache Apisix is a cloud-native microservices API gateway service from the Apache USA Foundation. The software is implemented based on OpenResty and etcd, with dynamic routing and plugin hot loading, suitable for API management under the microservices system. A security vulnerability exists in...

CVE-2025-62232: Insertion of Sensitive Information into Log File

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: ...

PT-2025-44457

Name of the Vulnerable Software and Affected Versions Apache APISIX versions prior to 3.14 Description A flaw exists where sensitive data, specifically usernames and passwords used in basic authentication, are exposed through logging. When the log level is set to INFO or DEBUG, these credentials...

EUVD-2021-19905

Malware in sbrugna...

EUVD-2022-30412

Malicious code in bioql PyPI...

EUVD-2025-19707

Malicious code in bioql PyPI...

EUVD-2024-30440

Malicious code in bioql PyPI...

EUVD-2025-20132

Malicious code in bioql PyPI...

BIT-APISIX-2025-27446 Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

Apache Apisix elevation of privilege vulnerability (CNVD-2025-20873)

Apache Apisix is a cloud-native microservices API gateway service of the U.S. Apache Apache Foundation. The software is based on OpenResty and etcd to realize , with dynamic routing and plug-in hot loading , suitable for microservice system under the API management . An elevation of privilege...