AP
Product
APISIX
On CISA KEVExploited in the wild
29
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 14Medium 8Low 0
Watch
Add APISIX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24112 In wildKEV | 9.8 | Feb 11 | apisix/batch-requests plugin allows overwriting the X-REAL-IP header Affected: before 2.10.4; 2.11.0 before 2.12.1 |
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: before 3.6.1 |
| CVE-2022-25757 | 9.8 | Mar 28 | In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result Affected: before 2.13.0 |
| CVE-2026-49871 | 9.3 | Jun 19 | Apache APISIX: cas-auth login CSRF / session injection issue Affected: 3.0.0 before 3.17.0 |
| CVE-2026-49230 | 9.1 | Jun 19 | Apache APISIX: Authentication bypass in jwe-decrypt Affected: 3.8.0 before 3.17.0 |
| CVE-2026-44087 | 9.1 | Jun 19 | Apache APISIX: Openid-connect plugin Identity Header Spoofing Affected: 2.3 before 3.17.0 |
| CVE-2026-39999 | 9.1 | Jun 19 | Apache APISIX: JWT Algorithm Confusion allows authentication bypass Affected: 2.2 before 3.17.0 |
| CVE-2026-31908 | 9.1 | Apr 14 | Apache APISIX: forward auth plugin allows header injection Affected: 2.12.0 before 3.16.0 |
| CVE-2026-63041 | 8.8 | Aug 26 | Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers Affected: 3.11.0 before 3.18.0 |
| CVE-2026-39998 | 8.8 | Jun 19 | Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup Affected: 2.12.0 before 3.17.0 |
| CVE-2026-75020 | 8.1 | Aug 27 | Apache APISIX: ldap-auth plugin cross-subtree identity impersonation Affected: 2.11.0 before 3.18.0 |
| CVE-2026-49872 | 8.1 | Jun 19 | Apache APISIX: Improper authentication in cas-auth plugin Affected: 3.0.0 before 3.17.0 |
| CVE-2026-47339 | 8.1 | Jun 19 | Apache APISIX: authz-casdoor incorrect session sharing Affected: 2.14.1 before 3.17.0 |
| CVE-2025-27446 | 7.8 | Jul 6 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner) Affected: 0.2 through 0.5 |
| CVE-2026-74848 | 7.5 | Aug 27 | Apache APISIX: Cross-user response poisoning in serverless plugins Affected: 2.12.0 before 3.18.0 |
| CVE-2026-75005 | 7.5 | Aug 27 | Apache APISIX: Unauthenticated CPU-exhaustion DoS Affected: 3.17.0 |
| CVE-2026-31923 | 7.5 | Apr 14 | Apache APISIX: Openid-connect `tls_verify` field is disabled by default Affected: 0.7 before 3.16.0 |
| CVE-2025-62232 | 7.5 | Oct 31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG Affected: 1.0 before 3.14.0 |
| CVE-2022-29266 | 7.5 | Apr 20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt… Affected: before 2.13.1 |
| CVE-2021-43557 | 7.5 | Nov 22 | The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification Affected: before 2.10.2 |
| CVE-2026-48895 | 7.2 | Jun 19 | Apache APISIX: Cas-auth Host header influence on CAS service URL Affected: 3.0.0 before 3.17.0 |
| CVE-2026-47341 | 6.5 | Jun 19 | Apache APISIX: Session replay issue in hmac-auth Affected: 3.11.0 before 3.17.0 |
| CVE-2020-13945 | 6.5 | Dec 7 | In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules Affected: 1.2 through 1.5 |
| CVE-2024-32638 | 6.3 | May 2 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from… Affected: 3.8.0; 3.9.0 |
| CVE-2026-44915 | 6.1 | Jun 19 | Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value Affected: 3.0.0 before 3.17.0 |
| CVE-2026-44046 | 5.8 | Jun 19 | Apache APISIX: wolf-rbac plugin Identity Spoofing Affected: 1.2 before 3.17.0 |
| CVE-2026-49231 | 5.4 | Jun 19 | Apache APISIX: Identity spoofing issue in APISIX opa plugin Affected: 3.5.0 before 3.17.0 |
| CVE-2026-31924 | 5.3 | Apr 14 | Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP Affected: 2.99.0 before 3.16.0 |
| CVE-2025-46647 | 5.3 | Jul 2 | A vulnerability of plugin openid-connect in Apache APISIX Affected: before 3.12.0 |
Showing 29