Apache Software Foundation Apache APISIX

• CVE-2022-24112 Critical 9.8 Exploited apisix/batch-requests plugin allows overwriting the X-REAL-IP header 96.1%
• CVE-2026-94276 Medium 5.1 Apache APISIX: Openid-connect introspection validation issue 0.3%
• CVE-2026-94269 Medium 6.3 Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch 0.3%
• CVE-2026-94250 High 8.2 Apache APISIX: Batch response aggregation can exhaust worker memory 0.3%
• CVE-2026-94220 Low 2.1 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin 0.2%
• CVE-2026-94212 Medium 6.4 Apache APISIX: unauthenticated impersonation issue in saml-auth 0.2%
• CVE-2026-82806 Medium 5.3 Apache APISIX: cross-request permission pollution via static permission list mutation 0.3%
• CVE-2026-78242 Medium 5.7 Apache APISIX: data-mask may fail to redact request headers in logger output 0.1%
• CVE-2026-74848 High 7.0 Apache APISIX: Cross-user response poisoning in serverless plugins 0.6%
• CVE-2026-75005 High 8.7 Apache APISIX: Unauthenticated CPU-exhaustion DoS 0.7%
• CVE-2026-75020 High 7.0 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation 0.5%
• CVE-2026-63041 Medium 5.3 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers 0.7%
• CVE-2026-49872 Medium 5.3 Apache APISIX: Improper authentication in cas-auth plugin 0.5%
• CVE-2026-49871 Low 2.1 Apache APISIX: cas-auth login CSRF / session injection issue 0.4%
• CVE-2026-47341 Medium 6.3 Apache APISIX: Session replay issue in hmac-auth 0.7%
• CVE-2026-48895 Low 2.1 Apache APISIX: Cas-auth Host header influence on CAS service URL 0.6%
• CVE-2026-49231 Low 2.3 Apache APISIX: Identity spoofing issue in APISIX opa plugin 0.6%
• CVE-2026-49230 Medium 6.3 Apache APISIX: Authentication bypass in jwe-decrypt 0.3%
• CVE-2026-44915 Low 2.1 Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value 0.6%
• CVE-2026-44087 Medium 5.3 Apache APISIX: Openid-connect plugin Identity Header Spoofing 0.3%
• CVE-2026-47339 Medium 5.3 Apache APISIX: authz-casdoor incorrect session sharing 0.5%
• CVE-2026-44046 Low 2.3 Apache APISIX: wolf-rbac plugin Identity Spoofing 0.5%
• CVE-2026-39999 High 7.0 Apache APISIX: JWT Algorithm Confusion allows authentication bypass 0.6%
• CVE-2026-39998 Medium 5.8 Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup 0.7%
• CVE-2026-31923 High 7.5 Apache APISIX: Openid-connect `tls_verify` field is disabled by default 0.2%
• CVE-2026-31924 Medium 5.3 Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP 0.2%
• CVE-2026-31908 Critical 9.1 Apache APISIX: forward auth plugin allows header injection 0.5%
• CVE-2025-62232 High 7.5 Apache APISIX: basic-auth logs plaintext credentials at info level 0.5%
• CVE-2025-46647 Medium 5.3 Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect 0.5%
• CVE-2024-32638 Medium 6.3 Apache APISIX: Forward-Auth Request Smuggling 1.1%
• CVE-2022-29266 Unrated apisix/jwt-auth may leak secrets in error response 8.1%
• CVE-2022-25757 Unrated Apache APISIX: the body_schema check in request-validation plugin can be bypassed 2.5%
• CVE-2021-43557 Unrated Path traversal in request_uri variable 13.0%
• CVE-2020-13945 Unrated In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 73.6%