Authentication Bypass Vulnerability in Apache APISIX by Apache
CVE-2026-124666

6.4MEDIUM

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124666?

The vulnerability allows an attacker to bypass authentication mechanisms by spoofing identity headers in Apache APISIX. When multi-authentication fails over from Wolf-RBAC to another authenticator, the original client-supplied Wolf identity headers can persist in the request. This may mislead downstream services that depend on these headers, potentially leading to unauthorized access. Users should move to version 3.20.0 or later for protection against this issue.

Affected Version(s)

Apache APISIX 3.8.0 <= 3.19.0

References

https://lists.apache.org/thread/1kpvbj2m069bnhod8rwyx0mdz...
vendor-advisory

CVSS V4

Score:
6.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ziyue
shreemaan-abhishek
shreemaan-abhishek
.