Authentication Bypass Vulnerability in Apache APISIX by Apache
CVE-2026-124719

2.3LOW

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124719?

An authentication bypass vulnerability exists in Apache APISIX due to improper validation of headers related to caller identity in routing configurations. When a Route is configured with specific headers and the corresponding header is declared in the OpenAPI document, a malicious actor could impersonate another identity when accessing the upstream API. This flaw can lead to unauthorized access and potential compromise of protected resources. Users are strongly encouraged to upgrade to version 3.20.0 to mitigate this issue.

Affected Version(s)

Apache APISIX 3.19.0 < 3.20.0

References

https://lists.apache.org/thread/k7v3vfh09mr1spk4r5k8n1gsj...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kai (GitHub: ha2fde)
shreemaan-abhishek
.