Relative Path Traversal Vulnerability in Apache APISIX from Apache
CVE-2026-124726

6.9MEDIUM

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124726?

A Relative Path Traversal vulnerability has been identified in Apache APISIX, affecting versions from 3.19.0 to 3.20.0. This issue allows a caller of the MCP endpoint to access endpoints that were not declared in the OpenAPI document, leveraging credentials added by the Route. Such unintended access can lead to exposure of sensitive data or functionality, urging users to upgrade to version 3.20.0 to mitigate the risk.

Affected Version(s)

Apache APISIX 3.19.0 < 3.20.0

References

https://lists.apache.org/thread/1kodokhflvr51sc1qv985om3s...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Javier GarcĂ­a Herrera
shreemaan-abhishek
shreemaan-abhishek
.