Apache discloses seven APISIX CVEs, one high severity

Seven Apache APISIX flaws disclosed on 1 October 2026 include a high-severity batch-requests memory issue and several auth bugs; none are reported exploited.

On 1 October 2026, oss-security posts disclosed seven Apache APISIX vulnerabilities, and none of the reports say the flaws are being exploited. The highest-rated is CVE-2026-94250 (CVSS 4.0 8.2), an unbounded resource-allocation flaw in the batch-requests plugin on versions 1.3.0 through 3.18.0 that can let an unauthenticated caller drive a gateway worker out of memory when the batch endpoint is publicly exposed. CVE-2026-94212 (CVSS 4.0 6.4) affects 3.17.0 through 3.18.0: saml-auth fails to verify cryptographic signatures, and under the default configuration an unauthenticated attacker can impersonate any user on every route protected by that plugin. CVE-2026-94269 (CVSS 4.0 6.3) affects 2.14.1 through 3.18.0 and can let a crafted encoded path reach an upstream when a permissive route overlaps a protected one, so the matched route's authorization policies never apply. CVE-2026-78242 (CVSS 4.0 5.7, only 3.17.0, local, low privileges) can write unmasked request headers to logs and users are advised to upgrade; CVE-2026-82806 (CVSS 4.0 5.3, 2.3.0 before 3.7.0 with authz-keycloak) can carry one request's authorization scope to later requests; CVE-2026-94276 (CVSS 4.0 5.1, 3.12.0 through 3.18.0) can accept a token introspected as active for the wrong issuer under remote introspection against a multi-issuer server, with high subsequent confidentiality and low integrity; and CVE-2026-94220 (CVSS 4.0 2.1, 3.17.0 through 3.18.0) is session fixation, also described as cross-site request forgery, in feishu-auth and dingtalk-auth and requires a victim to open a crafted link. The posts do not disagree on scores or affected version ranges.