Apache APISIX vulnerabilities

29 CVEs affecting Apache APISIX, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-75020, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerability, published 2022-02-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 96.1% chance of exploitation in the next 30 days. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote…
CVE-2020-13945, published 2020-12-07. Medium severity, CVSS 6.5. EPSS: 73% chance of exploitation in the next 30 days. In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects…
CVE-2021-43557, published 2021-11-22. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to…
CVE-2022-29266, published 2022-04-20. High severity, CVSS 7.5. EPSS: 8.1% chance of exploitation in the next 30 days. In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive…
CVE-2022-25757, published 2022-03-28. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass…
CVE-2024-32638, published 2024-05-02. Medium severity, CVSS 6.3. EPSS: 1.1% chance of exploitation in the next 30 days. Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are…
CVE-2026-75005, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue…
CVE-2026-47341, published 2026-06-19. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects…
CVE-2026-63041, published 2026-08-26. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain…

Latest

CVE-2026-75020, published 2026-08-27. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can…
CVE-2026-74848, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users'…
CVE-2026-49872, published 2026-06-19. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue…
CVE-2026-49871, published 2026-06-19. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by…
CVE-2026-49231, published 2026-06-19. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow…
CVE-2026-49230, published 2026-06-19. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache…
CVE-2026-48895, published 2026-06-19. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session…