CVE-2022-24112

CVE-2022-24112 Apache APISIX batch-requests RCECVE-2022-24112 Place the target in url.txt python3 ApacheAPISIXRCECVE-2022-24112.py Cmd:...

cve-2022-24112

Apache APISIX 2.12.1 Remote Code Execution and Docker Lab Let's clone using gitclone this repository, then we can navigate to apisix-docker/examples. In this docker-compose.yml file, we already change into image: apache/apisix:2.12.0-alpine, because the vulnerability in this version, then let's...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE - Multi-threaded batch vulnerability detection FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: IP:PORT/apisix/admin/migrate/export If this helps, please give the author a star before you leave, thank you! Batch...

CVE-2026-124726

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before...

CVE-2026-124716

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0...

CVE-2026-124666

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore...

CVE-2026-124679

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forwardheader distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-au...

CVE-2026-124680

Interpretation Conflict, resulting in Incorrect Authorization vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. Th...

CVE-2026-124719

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0...

CVE-2026-124723

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With matchuriencodedslash enabled and skipmtlsuriregex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted...

EUVD-2026-125682

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forwardheader distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-au...

CVE-2026-124679 Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forwardheader distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-au...

CVE-2026-124679

Apache APISIX versions 3.18.0 through 3.19.0 are vulnerable to an authentication bypass by spoofing vulnerability. The root cause occurs when routes use jwe-decrypt with strict: false and a forward_header distinct from the token header, allowing unauthenticated clients to supply values treated as...

CVE-2026-124716 Apache APISIX: authz-keycloak authorization scope mismatch

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0...

CVE-2026-124716

Apache APISIX versions 1.4.0 through 3.19.0 are impacted by an Incorrect Authorization vulnerability. An authenticated user possessing only one of the required permissions or scopes for a route can successfully access the protected upstream. This allows the user to bypass remaining security requi...

EUVD-2026-125681

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0...

CVE-2026-124666 Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore...

EUVD-2026-125679

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore...

CVE-2026-124666

Apache APISIX versions 3.8.0 through 3.19.0 are vulnerable to an authentication bypass by spoofing (CWE-290). The root cause is that during multi-auth processes, if the system falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers may persist in the r...

CVE-2026-124680 Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Interpretation Conflict, resulting in Incorrect Authorization vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. Th...