CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation
Apache APISIX authz-keycloak can carry one request's permissions into later requests (CVE-2026-82806).
CVE-2026-82806 is a medium-severity session-handling flaw, CVSS 4.0 5.3, in Apache APISIX from 2.3.0 before 3.7.0. It is described as exposure of a data element to the wrong session through mutation of a static permission list. Under a supported authz-keycloak configuration, one request's authorization scope can persist and affect later requests on the same route. Active exploitation is not mentioned.
- CVE-2026-82806 is rated CVSS 4.0 5.3 (medium).
- Affects Apache APISIX from 2.3.0 before 3.7.0.
- Requires a supported authz-keycloak configuration.
- One request's authorization scope can apply to later requests.
- CVEs
- CVE-2026-82806
- Vendors
- Apache Software Foundation
- Products
- Apache APISIX
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82806 | Cross-request authorization leak in Apache APISIX | 5.3 | — |
From the original article
Posted by Abhishek Choudhary on Oct 01 Severity: CVSS 4. 0: 5. 3 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.