NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#apisix

0 stories this week · 3 this month · 3 in 6 months · mostly security

Stories per day · 30 days

Relatedapache3 api-gateway2 authentication1 authorization-bypass1 cve-2026-782421 cve-2026-942691 cve-2026-942761 data-mask1 information-disclosure1 logging1 openid-connect1 url-normalization1

2 stories, newest first · one card per story

oss-security29d ago

CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue

Apache APISIX versions 3.12.0–3.18.0 can accept a token introspected as active for the wrong issuer.

2

oss-security29d ago

CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch

Apache APISIX 2.14.1–3.18.0 can let encoded paths bypass route authorization and reach protected upstreams.

6 sources apache apisix

4