LDAP Injection Vulnerability in Apache APISIX from Apache
CVE-2026-75020

7HIGH

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
27 August 2026

What is CVE-2026-75020?

An LDAP Injection vulnerability exists in Apache APISIX, allowing authenticated users with valid credentials to authenticate as a different consumer than intended. This misconfiguration in LDAP queries can lead to unauthorized access, as users could access entries outside of their legitimate scope. To mitigate this risk, users should upgrade to Apache APISIX version 3.18.0, which resolves this vulnerability.

Affected Version(s)

Apache APISIX 2.11.0 <= 3.17.0

References

https://lists.apache.org/thread/d4007wk6dbl9mxy5h05zxwn8f...
vendor-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MopMonk AI
.