Actively exploited in the wild
Apache APISIX Authentication Bypass Vulnerability
Apache - APISIX · Listed in the CISA KEV since 2022-08-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-24112
CriticalCVSS 9.8KEVSummary
In Apache APISIX, an attacker can abuse the batch-requests plugin to bypass the IP restriction of the Admin API. A default configuration (with default API key) is vulnerable to remote code execution; even after changing the admin key or port, there is still a risk of bypassing the IP restriction of the data panel due to a bug in the client IP check.
Risk Assessment
An attacker can gain unauthorized access to the administrative API and execute arbitrary code, taking control of the API gateway. Even after changing default settings, the risk of bypassing IP restrictions remains.
Recommendation
Update Apache APISIX to a patched version. Change the default API key, restrict Admin API access to trusted networks, and consider disabling the batch-requests plugin if not needed.
Other vulnerabilities in Apache APISIX
See all- CVE-2026-94276Medium
Apache APISIX versions 3.12.0 through 3.18.0 contain an improper authentication vulnerability in the openid-connect plugin. A token that is active for one issuer may be accepted on a route restricted to another issuer when remote introspection is used.
- CVE-2026-94269Medium
Apache APISIX versions 2.14.1 through 3.18.0 contain a vulnerability in the use of non-canonical URL paths for authorization decisions. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover, allowing unauthenticated access.
- CVE-2026-94250High
The batch-requests plugin in Apache APISIX allows allocation of resources without limits or throttling. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. The issue affects Apache APISIX from 1.3.0 through 3.18.0.
- CVE-2026-94220Low
Cross-Site Request Forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. Affects Apache APISIX from 3.17.0 through 3.18.0.
- CVE-2026-94212Medium
Apache APISIX versions 3.17.0 through 3.18.0 contain an improper verification of cryptographic signature vulnerability in the saml-auth plugin. An unauthenticated attacker can impersonate any user on routes protected by this plugin under default configuration.
- CVE-2026-82806Medium
Vulnerability in Apache APISIX exposing data to the wrong session. Under certain authz-keycloak configurations, a request's authorization scope may persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Affects versions from 2.3.0 before 3.7.0.
- CVE-2026-78242Medium
A vulnerability in Apache APISIX 3.17.0 causes unmasked header values to be written to the log sink under a certain response structure. The issue is fixed in version 3.18.0.
- CVE-2026-49230Critical
The vulnerability related to improper validation of integrity check value in Apache APISIX allows authentication bypass in the jwe-decrypt plugin under default configuration. This issue affects versions from 3.8.0 to 3.16.0.
- CVE-2026-39999Critical
Authentication Bypass by Spoofing vulnerability in Apache APISIX allows an attacker to completely bypass the authentication process by capitalizing on certain configurations of the jwt-auth plugin. This issue affects Apache APISIX from v2.2 through v3.16.0.
- CVE-2026-75020High
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
Original NVD description (English source)
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS