AA
Product
Apache APISIX
On CISA KEVExploited in the wild
27
CVEs
1
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 6High 10Medium 10Low 1
Watch
Add Apache APISIX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24112 In wildKEV | 9.8 | Feb 11 | apisix/batch-requests plugin allows overwriting the X-REAL-IP header Affected: Apache APISIX 2.12 before 2.12.1; Apache APISIX 2.10 before 2.10.4; 1.3 before Apache APISIX 1* |
| CVE-2026-49871 | 9.3 | Jun 19 | Apache APISIX: cas-auth login CSRF / session injection issue Affected: 3.0.0 through 3.16.0 |
| CVE-2026-49230 | 9.1 | Jun 19 | Apache APISIX: Authentication bypass in jwe-decrypt Affected: 3.8.0 through 3.16.0 |
| CVE-2026-44087 | 9.1 | Jun 19 | Apache APISIX: Openid-connect plugin Identity Header Spoofing Affected: 2.3 through 3.16.0 |
| CVE-2026-39999 | 9.1 | Jun 19 | Apache APISIX: JWT Algorithm Confusion allows authentication bypass Affected: 2.2 through 3.16.0 |
| CVE-2026-31908 | 9.1 | Apr 14 | Apache APISIX: forward auth plugin allows header injection Affected: 2.12.0 through 3.15.0 |
| CVE-2026-63041 | 8.8 | Aug 26 | Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers Affected: 3.11.0 through 3.17.0 |
| CVE-2026-39998 | 8.8 | Jun 19 | Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup Affected: 2.12.0 through 3.16.0 |
| CVE-2026-94250 | 8.2 | Oct 1 | Apache APISIX: Batch response aggregation can exhaust worker memory Affected: 1.3.0 through 3.18.0 |
| CVE-2026-75020 | 8.1 | Aug 27 | Apache APISIX: ldap-auth plugin cross-subtree identity impersonation Affected: 2.11.0 through 3.17.0 |
| CVE-2026-49872 | 8.1 | Jun 19 | Apache APISIX: Improper authentication in cas-auth plugin Affected: 3.0.0 through 3.16.0 |
| CVE-2026-47339 | 8.1 | Jun 19 | Apache APISIX: authz-casdoor incorrect session sharing Affected: 2.14.1 through 3.16.0 |
| CVE-2026-74848 | 7.5 | Aug 27 | Apache APISIX: Cross-user response poisoning in serverless plugins Affected: 2.12.0 through 3.17.0 |
| CVE-2026-75005 | 7.5 | Aug 27 | Apache APISIX: Unauthenticated CPU-exhaustion DoS Affected: 3.17.0 |
| CVE-2026-31923 | 7.5 | Apr 14 | Apache APISIX: Openid-connect `tls_verify` field is disabled by default Affected: 0.7 through 3.15.0 |
| CVE-2026-48895 | 7.2 | Jun 19 | Apache APISIX: Cas-auth Host header influence on CAS service URL Affected: 3.0.0 through 3.16.0 |
| CVE-2026-47341 | 6.5 | Jun 19 | Apache APISIX: Session replay issue in hmac-auth Affected: 3.11.0 through 3.16.0 |
| CVE-2026-94212 | 6.4 | Oct 1 | Apache APISIX: unauthenticated impersonation issue in saml-auth Affected: 3.17.0 through 3.18.0 |
| CVE-2026-94269 | 6.3 | Oct 1 | Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch Affected: 2.14.1 through 3.18.0 |
| CVE-2026-44915 | 6.1 | Jun 19 | Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value Affected: 3.0.0 through 3.16.0 |
| CVE-2026-44046 | 5.8 | Jun 19 | Apache APISIX: wolf-rbac plugin Identity Spoofing Affected: 1.2.0 through 3.16.0 |
| CVE-2026-78242 | 5.7 | Oct 1 | Apache APISIX: data-mask may fail to redact request headers in logger output Affected: 3.17.0 |
| CVE-2026-49231 | 5.4 | Jun 19 | Apache APISIX: Identity spoofing issue in APISIX opa plugin Affected: 3.5.0 through 3.16.0 |
| CVE-2026-82806 | 5.3 | Oct 1 | Apache APISIX: cross-request permission pollution via static permission list mutation Affected: 2.3.0 before 3.7.0 |
| CVE-2026-31924 | 5.3 | Apr 14 | Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP Affected: 2.99.0 through 3.15.0 |
| CVE-2026-94276 | 5.1 | Oct 1 | Apache APISIX: Openid-connect introspection validation issue Affected: 3.12.0 through 3.18.0 |
| CVE-2026-94220 | 2.1 | Oct 1 | Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin Affected: 3.17.0 through 3.18.0 |
Showing 27