Data Exposure Vulnerability in Apache APISIX by Apache

CVE-2026-82806

What is CVE-2026-82806?

The vulnerability in Apache APISIX arises from the exposure of a data element that can lead to an incorrect session state. This occurs when a request's authorization scope persists across multiple requests on the same route under a supported authz-keycloak configuration. Such behavior can allow unintended authorization expansion, resulting in inconsistent access-control decisions. To mitigate this issue, users are advised to upgrade to version 3.7.0 or later, which addresses this vulnerability.

References