CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output
Apache APISIX 3.17.0 can write unmasked request headers to logs when data-mask fails.
34
Vulnerability6 · 2 reads
CVE-2026-78242
Unmasked header values logged in Apache APISIX 3.17.0
- CVSS 4.0
- 5.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache APISIX 3.17.0 can write unmasked request-header values into the log sink when the data-mask feature fails under a certain response structure. The flaw is insertion of sensitive information into log files (CWE-532): a local, low-privileged attacker who can reach that response path may cause secrets in headers to be stored in logs that should have been redacted. Impact is high confidentiality loss on the vulnerable system, with no integrity or availability effect and no impact on subsequent systems (CVSS 4.0 5.7). Only Apache APISIX 3.17.0 is affected; 3.18.0 fixes the issue. It is not in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade Apache APISIX from 3.17.0 to 3.18.0. Until then, restrict access to logger sinks and review existing logs for unmasked request-header values that the data-mask plugin should have redacted.
| Product | Affected |
|---|---|
| Apache APISIX | 3.17.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
- Weakness
- CWE-532
- Vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X