Skip to content
NewA calmer, faster ZeroHour
Vulnerability7 · 3 reads

CVE-2026-94269

Non-canonical URL auth bypass in Apache APISIX

CVSS 4.0
6.3 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-94269 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache APISIX can base authorization on non-canonical URL paths (CWE-647). In some configurations where a permissive route overlaps a protected one, a crafted encoded path is matched to the permissive route while the request is still forwarded to a protected upstream endpoint those policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to that protected upstream endpoint. This affects Apache APISIX from 2.14.1 through 3.18.0 and is fixed in 3.19.0. It is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Apache APISIX to 3.19.0. Until then, review configurations where a permissive route overlaps a protected one and ensure encoded or non-canonical paths are normalized or rejected before routing and authorization. After upgrading, check access logs for unexpected encoded-path requests that reached protected upstream endpoints.

ProductAffected
Apache APISIX2.14.1 through 3.18.0
Estimated exposure
moderatethousands to low tens of thousands of deployments (smaller internet-exposed subset) — Order-of-magnitude estimate from Apache APISIX’s wide use as an open-source API gateway in cloud and Kubernetes deployments; the CVE data has no install count or public scan total, and only some overlapping-route configurations are…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Weakness
CWE-647
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story