Incorrect Authorization in Apache APISIX by Apache
CVE-2026-124723

6.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124723?

An interpretation conflict in Apache APISIX allows unauthorized clients, who lack necessary certificates, to access upstream resources behind a route demanding authentication. This occurs under specific configurations, such as when match_uri_encoded_slash is enabled and skip_mtls_uri_regex is set. Users running versions 3.18.0 to 3.19.0 are particularly affected and should promptly upgrade to 3.20.0 to mitigate this risk.

Affected Version(s)

Apache APISIX 3.18.0 <= 3.19.0

References

https://lists.apache.org/thread/0r8dv4ytw5mkhrozlg7mgb9h6...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hataehoon
shreemaan-abhishek
shreemaan-abhishek
.