CVE-2026-124719 Apache APISIX: identity spoofing in openapi-to-mcp

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0...

CVE-2026-124719

Apache APISIX versions 3.19.0 through 3.19.x are vulnerable to an authentication bypass by spoofing in the openapi-to-mcp component. The vulnerability occurs when a Route's configured headers carry a caller identity while the OpenAPI document declares the same header, allowing a caller to imperso...

CVE-2026-124726 Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before...

CVE-2026-124726

Apache APISIX versions 3.19.0 before 3.20.0 are vulnerable to a Relative Path Traversal and Unintended Proxy vulnerability. A caller of the MCP endpoint can bypass the OpenAPI document's declared limits to invoke undeclared endpoints using the HTTP method of a declared tool and the credentials ad...