Approved changes feed: RSS · Atom
cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Apisix (1d25eca5-12cb-5103-b557-31380727ab1e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/apisix |
purl2cpe | 2026-06-01 10:14:31.109675 |
pkg:docker/apache/apisix |
purl2cpe | 2026-06-01 10:14:31.109678 |
pkg:github/apache/apisix |
purl2cpe | 2026-06-01 10:14:31.109681 |
pkg:sourceforge/apache-apisix.mirror |
purl2cpe | 2026-06-01 10:14:31.109683 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-31924 |
vulnerable | 2026-06-08 07:57:16.106983 |
Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
tencent-cloud-cls log export uses plaintext HTTP
This issue affects Apache APISIX: from 2.99.0 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Published: 2026-04-14T08:08:05.615Z
Updated: 2026-04-14T19:51:55.994Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31923 |
vulnerable | 2026-06-08 07:57:16.106583 |
Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default.
This issue affects Apache APISIX: from 0.7 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Published: 2026-04-14T08:38:59.039Z
Updated: 2026-04-14T18:16:34.559Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31908 |
vulnerable | 2026-06-08 07:57:16.092214 |
Apache APISIX: forward auth plugin allows header injection
Header injection vulnerability in Apache APISIX.
The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.
This issue affects Apache APISIX: from 2.12.0 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Published: 2026-04-14T08:06:18.026Z
Updated: 2026-04-16T12:06:00.176Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62232 |
vulnerable | 2026-06-08 07:37:28.929159 |
Apache APISIX: basic-auth logs plaintext credentials at info level
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.
It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629
Users are recommended to upgrade to version 3.14, which fixes this issue.
Published: 2025-10-31T08:48:23.592Z
Updated: 2025-10-31T13:58:14.534Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46647 |
vulnerable | 2026-06-08 07:27:08.565647 |
Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect
A vulnerability of plugin openid-connect in Apache APISIX.
This vulnerability will only have an impact if all of the following conditions are met:
1. Use the openid-connect plugin with introspection mode
2. The auth service connected to openid-connect provides services to multiple issuers
3. Multiple issuers share the same private key and relies only on the issuer being different
If affected by this vulnerability, it would allow an attacker with a valid account on one of the issuers to log into the other issuer.
This issue affects Apache APISIX: until 3.12.0.
Users are recommended to upgrade to version 3.12.0 or higher.
Published: 2025-07-02T11:08:47.179Z
Updated: 2025-11-04T21:10:49.580Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27446 |
vulnerable | 2026-06-08 07:14:54.981874 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-44487 |
vulnerable | 2026-06-08 06:12:41.191977 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29266 |
vulnerable | 2026-06-08 05:42:47.519841 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25757 |
vulnerable | 2026-06-08 05:41:49.382179 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24112 |
vulnerable | 2026-06-08 05:40:59.628119 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43557 |
vulnerable | 2026-06-08 05:36:43.551731 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13945 |
vulnerable | 2026-06-08 05:18:01.569907 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.