Apache APISIX

Search everything

Mentions · 7d0
Mentions · 30d7
All mentions7
First seenOct 1, 2026
Last mentioned29d ago

Timeline

7 articles · newest first

CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue

Apache APISIX versions 3.12.0–3.18.0 can accept a token introspected as active for the wrong issuer.

oss-securityOct 1, 12:18 UTC · 29d agoVulnerabilityCVE-2026-942762 · 1 read

CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch

Apache APISIX 2.14.1–3.18.0 can let encoded paths bypass route authorization and reach protected upstreams.

oss-securityOct 1, 12:16 UTC · 29d agoVulnerability 6 sourcesCVE-2026-942694 · 1 read

CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory

Unauthenticated callers can exhaust Apache APISIX worker memory via the batch-requests plugin (CVE-2026-94250).

oss-securityOct 1, 12:14 UTC · 29d agoVulnerability 6 sourcesCVE-2026-942506 · 2 reads

CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Apache APISIX feishu-auth and dingtalk-auth allow session fixation through a crafted link (CVE-2026-94220).

oss-securityOct 1, 12:11 UTC · 29d agoVulnerability 6 sourcesCVE-2026-942203 · 1 read

CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth

Default Apache APISIX saml-auth lets unauthenticated attackers impersonate any user (CVE-2026-94212).

oss-securityOct 1, 12:09 UTC · 29d agoVulnerability 6 sourcesCVE-2026-942122

CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation

Apache APISIX authz-keycloak can carry one request's permissions into later requests (CVE-2026-82806).

oss-securityOct 1, 12:06 UTC · 29d agoVulnerability 6 sourcesCVE-2026-828061

CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output

Apache APISIX 3.17.0 can write unmasked request headers to logs when data-mask fails.

oss-securityupdated Oct 1, 12:16 UTC · 29d agofirst Oct 1, 12:04 UTC · 29d agoVulnerability 6 sourcesCVE-2026-782422 · 1 read

Related CVEs

by mentions

CVE-2026-942508.2
Unauthenticated worker OOM in Apache APISIX batch-requests
published 29d agoApache Software Foundation Apache APISIX
CVE-2026-942126.4
Signature verification flaw enables impersonation in Apache APISIX
published 29d agoApache APISIX
CVE-2026-942696.3
Non-canonical URL auth bypass in Apache APISIX
published 29d agoApache APISIX
CVE-2026-782425.7
Unmasked header values logged in Apache APISIX 3.17.0
published 29d agoApache APISIX
CVE-2026-828065.3
Cross-request authorization leak in Apache APISIX
published 29d agoApache Software Foundation APISIX
CVE-2026-942765.1
Improper Authentication in Apache APISIX OpenID-Connect
published 29d agoApache APISIX
CVE-2026-942202.1
CSRF session fixation in Apache APISIX Feishu and DingTalk auth
published 29d agoApache APISIX (feishu-auth and dingtalk-auth plugins)

Appears with

Apache Software Foundationorganization · 6
Apache Software Foundationvendor · 5
Apachevendor · 2

Entities are extracted by the model from each article. First seen Oct 1, 2026, last mentioned 29d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.