CVE-2022-23944: Apache Shenyu

Critical severity, CVSS 9.1. EPSS: 79% chance of exploitation in the next 30 days.

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Affected products

• Apache Shenyu: version 2.4.0 only; version 2.4.1 only

Published 2022-01-25. Last modified 2026-06-17.