# CVE-2026-75020: Apache APISIX LDAP injection in ldap-auth plugin

Source: https://junglewise.ai/threats/cve-2026-75020-apache-apisix-ldap-injection-in-ldap-auth-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75020 · Severity: high · CVSS 8.1 · Published 2026-08-27

Apache APISIX is an API gateway platform used to manage and route API traffic. The LDAP authentication plugin has an LDAP injection flaw that allows an attacker with valid credentials for one user account to impersonate a different user account and bypass intended access restrictions, potentially gaining unauthorized access to protected APIs and data.

Technologies: [Apache APISIX](https://junglewise.ai/threats/technologies/apisix). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-75020 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75020 being exploited in the wild.

**How severe is CVE-2026-75020?** High severity, with a CVSS score of 8.1, published 27 August 2026.

**Which products and versions are affected?** Apache APISIX 2.11.0 through 3.17.0.

**Is there a fix for CVE-2026-75020?** A patch was published on 2026: Version 3.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75020 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75020?** Check whether you run Apache APISIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an LDAP injection (CWE-90) in the ldap-auth plugin that fails to properly neutralize special elements in LDAP queries. An attacker with valid credentials for one LDAP directory entry can craft LDAP queries that authenticate as a different entry outside the plugin's configured scope. The vulnerability requires network access to APISIX and valid LDAP credentials for at least one directory entry. An attacker can achieve unauthorized authentication and privilege escalation by impersonating other users. The issue affects versions 2.11.0 through 3.17.0; Apache has released version 3.18.0 as a patch.

## Affected products

- Apache APISIX 2.11.0 through 3.17.0

## Timeline

- 2026-08-26: disclosed
- 2026-08-27: advisory
- 2026: patched: Version 3.18.0 released with fix

## References

- [https://lists.apache.org/thread/d4007wk6dbl9mxy5h05zxwn8fsg13bxt](https://lists.apache.org/thread/d4007wk6dbl9mxy5h05zxwn8fsg13bxt)
- [http://www.openwall.com/lists/oss-security/2026/08/26/14](http://www.openwall.com/lists/oss-security/2026/08/26/14)

## Related threats

- [Apache APISIX improper authentication in openid-connect plugin](https://junglewise.ai/threats/cve-2026-94276-improper-authentication-vulnerability-in-apache-apisix-on-a-route)
- [Apache APISIX authorization bypass via non-canonical URL paths](https://junglewise.ai/threats/cve-2026-94269-use-of-non-canonical-url-paths-for-authorization-decisions)
- [Apache APISIX batch-requests plugin uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-94250-allocation-of-resources-without-limits-or-throttling)
- [Apache APISIX feishu-auth and dingtalk-auth session fixation](https://junglewise.ai/threats/cve-2026-94220-cross-site-request-forgery-csrf-vulnerability-in-feishu-auth-and)
- [Apache APISIX cryptographic signature verification bypass in saml-auth](https://junglewise.ai/threats/cve-2026-94212-improper-verification-of-cryptographic-signature-vulnerability-in)