CVE-2026-63041

This vulnerability affects the attach-consumer-label plugin in Apache APISIX , an API gateway. The plugin fails to strip client-supplied consumer-label headers, leading to a reliance on untrusted inputs in security decisions . An attacker can send crafted header values to escalate privileges or b...