CVE-2026-74848

Apache APISIX is vulnerable to an HTTP Request/Response Smuggling flaw in serverless-plugin routes , allowing an unauthenticated network attacker to cause other clients to receive attacker-chosen or cross-user responses. The issue affects versions 2.12.0 through 3.17.0 and is fixed in version 3.1...

CVE-2026-75005 Apache APISIX: Unauthenticated CPU-exhaustion DoS

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue...

EUVD-2026-66957

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue...

CVE-2026-75005

Apache APISIX 3.17.0 is affected by an Inefficient Algorithmic Complexity vulnerability in graphql-limit-count routes, rated CVSS 4.0 8.7 (HIGH) . A single small request can pin a gateway worker at 100% CPU for an extended period, causing a denial-of-service. The attack requires no authentication...

CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...

EUVD-2026-66956

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...

CVE-2026-75020

This LDAP Injection vulnerability in Apache APISIX's ldap-auth plugin (versions 2.11.0 through 3.17.0 ) allows a caller holding valid credentials for one LDAP directory entry to authenticate as a consumer mapped to a different entry, effectively bypassing the plugin's configured scope and enablin...

CVE-2026-31908

CVE-2026-31908 - Exploit di Header Injection in Apache APISIX 📋 Panoramica Questo è un exploit Proof of Concept PoC per CVE-2026-31908 , una vulnerabilità critica di header injection scoperta in Apache APISIX versioni 2.12.0 fino a 3.15.0. La vulnerabilità esiste nel plugin forward-auth, dove una...

CVE-2021-45232

Apache APISIX Dashboard Schnittstelle ohne Autorisierung Beschreibung Dieses Tool integriert fofa- und POC-Ein-Klick-Erkennungsfunktionen und realisiert das Ein-Klick-Crawlen von fofa sowie die Ein-Klick-Erkennung gleichzeitiges Crawlen und Testen Verwendungsmethode Verwendete Version: python3 Vo...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE - Rilevamento batch di vulnerabilità multi-thread Query FOFA title="Apache APISIX Dashboard" Ambito di impatto Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export Se ti è stato utile, per favore lascia una stella prima di...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache APISIX Dashboard API unberechtigter RCE Version: 2.10.1 Fofa: Titel="Apache APISIX Dashboard" PoC: root@kitploit: IP:PORT/apisix/admin/migrate/export...

CVE-2022-24112

Apache APISIX 2.12.x - Exploit di Esecuzione Remota di Codice RCE Questo script Python è una Proof-of-Concept PoC per una vulnerabilità di esecuzione remota di codice RCE in Apache APISIX versioni 2.12.0 e 2.12.1. La vulnerabilità risiede nell'uso improprio del campo Lua filterfunc all'interno...

CVE-2021-45232

CVE-2021-45232 CVE-2021-45232 POC 1、Scan für die nicht autorisierte Zugriffsschwachstelle der Apache APISIX Dashboard-Schnittstelle CVE-2021-45232 2、Scan für Standardkennwörter des Apache APISIX Dashboards...

CVE-2026-63041

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

EUVD-2026-66409

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-63041

Apache APISIX's attach-consumer-label plugin fails to strip client-supplied consumer-label headers, allowing an authenticated attacker to escalate privileges or bypass authorization by sending crafted values. The vulnerability affects versions 3.11.0 through 3.17.0 and is fixed in 3.18.0 . NVD ra...

CVE-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2022-24112_POC

POC POC raccolti CVE-2022-24112 Per l'ambiente del campo di tiro 春秋云境:CVE-2022-24112, ho modificato due POC, modificando leggermente i POC dei due autori M4xSec e twseptian per adattarli al campo di tiro 春秋云境: 春秋云境:CVE-2022-24112: Apache Apisix è un gateway API cloud-native per microservizi della...

PT-2026-82088

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.11.0 through 3.17.0 Description An issue exists where the attach-consumer-label plugin fails to correctly sanitize certain input values. This allows an attacker to perform an authorization bypass or escalate privileges...