The vulnerability of the java-plugin-runner plugin for the Apache APISIX cloud API allows a hacker to escalate their privileges.

The vulnerability of the java-plugin-runner plugin of the Apache APISIX cloud API gateway is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to increase their privileges...

Apache Apisix elevation of privilege vulnerability (CNVD-2025-20873)

Apache Apisix is a cloud-native microservices API gateway service of the U.S. Apache Apache Foundation. The software is based on OpenResty and etcd to realize , with dynamic routing and plug-in hot loading , suitable for microservice system under the API management . An elevation of privilege...

CVE-2025-27446

The Apache APISIX (java-plugin-runner) component is vulnerable to an elevation of privilege due to incorrect permission assignments for critical resources. Specifically, improper permissions on a local listening file allow a local attacker to escalate their privileges. This issue affects versions...

Apache Apisix 安全漏洞

Apache Apisix is a cloud-native microservices API gateway service of the U.S. Apache Apache Foundation. The software is based on OpenResty and etcd to realize , with dynamic routing and plug-in hot loading , suitable for microservice system under the API management . An elevation of privilege...

CVE-2025-27446: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

PT-2025-28065 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIXjava-plugin-runner versions 0.2.0 through 0.5.0 Description: The issue is related to incorrect permission assignment for critical resources in the Apache APISIX java-plugin-runner, allowing a local attacker to elevate privileges...