# Apache Apisix vulnerabilities Source: https://junglewise.ai/threats/technologies/apisix Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/apisix.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 27 vulnerabilities in Apache Apisix: 0 in the last 7 days and 11 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-94276, was published on 1 October 2026. Nothing in the last four weeks, down from 7 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 11 - All time: 27 (2 critical, 1 exploited in the wild) ## About Apache Apisix Open-source API gateway for managing and routing API traffic. ## Latest Apache Apisix vulnerabilities - [CVE-2026-94276: Apache APISIX improper authentication in openid-connect plugin](https://junglewise.ai/threats/cve-2026-94276-improper-authentication-vulnerability-in-apache-apisix-on-a-route) (info, published 1 Oct 2026) - [CVE-2026-94269: Apache APISIX authorization bypass via non-canonical URL paths](https://junglewise.ai/threats/cve-2026-94269-use-of-non-canonical-url-paths-for-authorization-decisions) (info, published 1 Oct 2026) - [CVE-2026-94250: Apache APISIX batch-requests plugin uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-94250-allocation-of-resources-without-limits-or-throttling) (info, published 1 Oct 2026) - [CVE-2026-94220: Apache APISIX feishu-auth and dingtalk-auth session fixation](https://junglewise.ai/threats/cve-2026-94220-cross-site-request-forgery-csrf-vulnerability-in-feishu-auth-and) (info, published 1 Oct 2026) - [CVE-2026-94212: Apache APISIX cryptographic signature verification bypass in saml-auth](https://junglewise.ai/threats/cve-2026-94212-improper-verification-of-cryptographic-signature-vulnerability-in) (info, published 1 Oct 2026) - [CVE-2026-82806: Apache APISIX session data persistence in authorization scope](https://junglewise.ai/threats/cve-2026-82806-exposure-of-data-element-to-wrong-session-vulnerability-in-apache) (info, published 1 Oct 2026) - [CVE-2026-78242: Apache APISIX sensitive information insertion in log file](https://junglewise.ai/threats/cve-2026-78242-insertion-of-sensitive-information-into-log-file-vulnerability-in) (info, published 1 Oct 2026) - [CVE-2026-75020: Apache APISIX LDAP injection in ldap-auth plugin](https://junglewise.ai/threats/cve-2026-75020-apache-apisix-ldap-injection-in-ldap-auth-plugin) (high, CVSS 8.1, published 27 Aug 2026) - [CVE-2026-75005: Apache APISIX CPU exhaustion DoS in graphql-limit-count](https://junglewise.ai/threats/cve-2026-75005-apache-apisix-cpu-exhaustion-dos-in-graphql-limit-count) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-74848: Apache APISIX HTTP request smuggling in serverless plugins](https://junglewise.ai/threats/cve-2026-74848-apache-apisix-http-request-smuggling-in-serverless-plugins) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-63041: Apache APISIX authorization bypass in attach-consumer-label](https://junglewise.ai/threats/cve-2026-63041-apache-apisix-authorization-bypass-in-attach-consumer-label) (high, CVSS 8.8, published 26 Aug 2026) - [CVE-2026-49872: Apache APISIX improper authentication in cas-auth plugin](https://junglewise.ai/threats/cve-2026-49872-apache-apisix-improper-authentication-in-cas-auth-plugin) (info, CVSS 5.3, published 19 Jun 2026) - [CVE-2026-49871: Apache APISIX CSRF in cas-auth plugin](https://junglewise.ai/threats/cve-2026-49871-apache-apisix-csrf-in-cas-auth-plugin) (info, CVSS 2.1, published 19 Jun 2026) - [CVE-2026-49231: Apache APISIX authentication bypass in opa plugin](https://junglewise.ai/threats/cve-2026-49231-apache-apisix-authentication-bypass-in-opa-plugin) (info, CVSS 2.3, published 19 Jun 2026) - [CVE-2026-49230: Apache APISIX authentication bypass in jwe-decrypt plugin](https://junglewise.ai/threats/cve-2026-49230-apache-apisix-authentication-bypass-in-jwe-decrypt-plugin) (info, CVSS 6.3, published 19 Jun 2026) - [CVE-2026-48895: Apache APISIX open redirect in cas-auth plugin](https://junglewise.ai/threats/cve-2026-48895-apache-apisix-open-redirect-in-cas-auth-plugin) (info, CVSS 2.1, published 19 Jun 2026) - [CVE-2026-47339: Apache APISIX incorrect authorization in authz-casdoor plugin](https://junglewise.ai/threats/cve-2026-47339-apache-apisix-incorrect-authorization-in-authz-casdoor-plugin) (info, CVSS 5.3, published 19 Jun 2026) - [CVE-2026-44915: Apache APISIX open redirect in cas-auth plugin](https://junglewise.ai/threats/cve-2026-44915-apache-apisix-open-redirect-in-cas-auth-plugin) (info, CVSS 2.1, published 19 Jun 2026) - [CVE-2026-44087: Apache APISIX identity header spoofing in openid-connect plugin](https://junglewise.ai/threats/cve-2026-44087-apache-apisix-identity-header-spoofing-in-openid-connect-plugin) (info, CVSS 5.3, published 19 Jun 2026) - [CVE-2026-44046: Apache APISIX identity spoofing in wolf-rbac plugin](https://junglewise.ai/threats/cve-2026-44046-apache-apisix-identity-spoofing-in-wolf-rbac-plugin) (info, CVSS 2.3, published 19 Jun 2026) - [CVE-2026-39999: Apache APISIX authentication bypass in jwt-auth plugin](https://junglewise.ai/threats/cve-2026-39999-apache-apisix-authentication-bypass-in-jwt-auth-plugin) (info, CVSS 7, published 19 Jun 2026) - [CVE-2026-39998: Apache APISIX identity spoofing in forward-auth plugin](https://junglewise.ai/threats/cve-2026-39998-apache-apisix-identity-spoofing-in-forward-auth-plugin) (info, CVSS 5.8, published 19 Jun 2026) - [CVE-2026-31924: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses…](https://junglewise.ai/threats/cve-2026-31924-cleartext-transmission-of-sensitive-information-vulnerability-in) (medium, CVSS 5.3, published 14 Apr 2026) - [CVE-2026-31923: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in…](https://junglewise.ai/threats/cve-2026-31923-cleartext-transmission-of-sensitive-information-vulnerability-in) (high, CVSS 7.5, published 14 Apr 2026) - [CVE-2026-31908: Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in…](https://junglewise.ai/threats/cve-2026-31908-header-injection-vulnerability-in-apache-apisix-the-attacker-can) (critical, CVSS 9.1, published 14 Apr 2026) ## Most severe Apache Apisix vulnerabilities - [CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-24112-apache-apisix-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Aug 2022) - [CVE-2026-31908: Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in…](https://junglewise.ai/threats/cve-2026-31908-header-injection-vulnerability-in-apache-apisix-the-attacker-can) (critical, CVSS 9.1, published 14 Apr 2026) - [CVE-2026-63041: Apache APISIX authorization bypass in attach-consumer-label](https://junglewise.ai/threats/cve-2026-63041-apache-apisix-authorization-bypass-in-attach-consumer-label) (high, CVSS 8.8, published 26 Aug 2026) - [CVE-2026-75020: Apache APISIX LDAP injection in ldap-auth plugin](https://junglewise.ai/threats/cve-2026-75020-apache-apisix-ldap-injection-in-ldap-auth-plugin) (high, CVSS 8.1, published 27 Aug 2026) - [CVE-2026-75005: Apache APISIX CPU exhaustion DoS in graphql-limit-count](https://junglewise.ai/threats/cve-2026-75005-apache-apisix-cpu-exhaustion-dos-in-graphql-limit-count) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-74848: Apache APISIX HTTP request smuggling in serverless plugins](https://junglewise.ai/threats/cve-2026-74848-apache-apisix-http-request-smuggling-in-serverless-plugins) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2025-62232: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and…](https://junglewise.ai/threats/cve-2025-62232-sensitive-data-exposure-via-logging-in-basic-auth-leads-to) (high, CVSS 7.5, published 31 Oct 2025) - [CVE-2026-31923: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in…](https://junglewise.ai/threats/cve-2026-31923-cleartext-transmission-of-sensitive-information-vulnerability-in) (high, CVSS 7.5, published 14 Apr 2026) - [CVE-2026-31924: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses…](https://junglewise.ai/threats/cve-2026-31924-cleartext-transmission-of-sensitive-information-vulnerability-in) (medium, CVSS 5.3, published 14 Apr 2026) - [CVE-2026-39999: Apache APISIX authentication bypass in jwt-auth plugin](https://junglewise.ai/threats/cve-2026-39999-apache-apisix-authentication-bypass-in-jwt-auth-plugin) (info, CVSS 7, published 19 Jun 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 7 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 4 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 7 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache Apisix vulnerabilities", https://junglewise.ai/threats/technologies/apisix, 12 November 2026.