CVE-2026-82806

Apache APISIX from 2.3.0 before 3.7.0 has an exposure-of-data-element-to-wrong-session flaw (CWE-488) when a supported authz-keycloak configuration is in use. A request's authorization scope can persist into later requests on the same route because a static permission list is mutated, so a later request may inherit an earlier request's scope. That cross-request permission pollution can expand authorization and produce inconsistent access-control decisions for subsequent callers. Only deployments on the affected versions that use this authz-keycloak setup are impacted. No public proof of concept is known and the issue is not in CISA KEV.

What to do: Upgrade Apache APISIX to 3.7.0 or later. Until then, review routes that use the authz-keycloak plugin and treat authorization decisions on those routes as potentially inconsistent across requests; after upgrading, re-check access logs for unexpected grants on shared routes.