Executive brief
Apache APISIX is an API gateway platform used to manage and route API traffic. The LDAP authentication plugin has an LDAP injection flaw that allows an attacker with valid credentials for one user account to impersonate a different user account and bypass intended access restrictions, potentially gaining unauthorized access to protected APIs and data.
Technical details
The vulnerability is an LDAP injection (CWE-90) in the ldap-auth plugin that fails to properly neutralize special elements in LDAP queries. An attacker with valid credentials for one LDAP directory entry can craft LDAP queries that authenticate as a different entry outside the plugin's configured scope. The vulnerability requires network access to APISIX and valid LDAP credentials for at least one directory entry. An attacker can achieve unauthorized authentication and privilege escalation by impersonating other users. The issue affects versions 2.11.0 through 3.17.0; Apache has released version 3.18.0 as a patch.
Affected products
- Apache APISIX 2.11.0 through 3.17.0
Timeline
- 2026-08-26: disclosed
- 2026-08-27: advisory
- 2026: patched: Version 3.18.0 released with fix