CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output
Apache APISIX 3.17.0 can write unmasked request headers to logs when data-mask fails.
Apache disclosed CVE-2026-78242, a medium-severity issue in Apache APISIX 3.17.0 scored 5.7 under CVSS 4.0. The data-mask feature can fail to redact request headers, so unmasked header values are written to the log sink under a certain response structure. The vector is local, requires low privileges, and affects only version 3.17.0. Users are advised to upgrade; the report does not say the flaw is being exploited.
- CVE-2026-78242 affects only Apache APISIX 3.17.0.
- CVSS 4.0 score is 5.7, with a local attack vector.
- data-mask can fail and write raw request headers to logs.
- No in-the-wild exploitation is reported; users should upgrade.
- CVEs
- CVE-2026-78242
- Vendors
- Apache
- Products
- Apache APISIX
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78242 | Unmasked header values logged in Apache APISIX 3.17.0 | 5.7 | — |
From the original article
Posted by Abhishek Choudhary on Oct 01 Severity: CVSS 4. 0: 5. 7 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.