CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch
Apache APISIX 2.14.1–3.18.0 can let encoded paths bypass route authorization and reach protected upstreams.
Apache disclosed CVE-2026-94269, a medium-severity flaw (CVSS 4.0 base 6.3) in Apache APISIX 2.14.1 through 3.18.0. Servlet-style URL normalization can let a crafted encoded path hit an upstream when a permissive route overlaps a protected one, so the matched route's authorization policies never apply. The issue is use of non-canonical URL paths for authorization decisions. No in-the-wild exploitation is mentioned.
- CVE-2026-94269 scores CVSS 4.0 6.3, rated medium.
- Affects Apache APISIX versions 2.14.1 through 3.18.0.
- Crafted encoded paths can reach upstreams despite route policies.
- Requires a permissive route overlapping a protected route.
- CVEs
- CVE-2026-94269
- Vendors
- Apache
- Products
- Apache APISIX
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94269 | Non-canonical URL auth bypass in Apache APISIX | 6.3 | — |
From the original article
Posted by Abhishek Choudhary on Oct 01 Severity: CVSS 4. 0: 6. 3 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.