CVE-2026-82806: Apache Software Foundation Apache APISIX

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.

Affected products

• Apache Software Foundation Apache APISIX: from 2.3.0, before 3.7.0 (fixed in 3.7.0)

Published 2026-10-01. Last modified 2026-10-01.