CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue
Apache APISIX versions 3.12.0–3.18.0 can accept a token introspected as active for the wrong issuer.
Stories per day · 30 days
4 RSS
5 stories, newest first · one card per story
Stories tagged #api-gateway
CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory
Unauthenticated callers can exhaust Apache APISIX worker memory via the batch-requests plugin (CVE-2026-94250).
Postman adds security controls for AI agents, APIs, and MCP servers
Postman launched Fabric Gateway to govern how AI agents and LLMs discover and call APIs and MCP servers.
3
Traefik Labs brings independent verification to AI agent governance
Traefik Labs announces Sovereign Trust Plane in Traefik Hub, adding verifiable delegation, policy enforcement, and tamper-evident audit records for AI agent traffic.
3
So you want to use OpenRouter?
Simon Willison highlights OpenRouter pitfalls: provider routing makes the same model endpoint behave inconsistently across backends.