Apache Apisix
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Apisix (3327c6ee-ab0e-5a4f-ad58-2718366cfaff) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49872 |
vulnerable | 2026-07-29 00:57:45.736271 |
Apache APISIX: Improper authentication in cas-auth plugin
Improper Authentication vulnerability in Apache APISIX.
When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source.
This issue affects Apache APISIX: from 3.0.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Published: 2026-06-19T13:19:34.126Z
Updated: 2026-06-22T16:30:40.492Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49871 |
vulnerable | 2026-07-29 00:57:45.736072 |
Apache APISIX: cas-auth login CSRF / session injection issue
Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations.
This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity.
Actions the victim takes upstream are then attributed to attackers identity.
This issue affects Apache APISIX: from 3.0.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Published: 2026-06-19T13:18:36.767Z
Updated: 2026-06-22T16:21:31.946Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49231 |
vulnerable | 2026-07-29 00:57:45.291359 |
Apache APISIX: Identity spoofing issue in APISIX opa plugin
Authentication Bypass by Spoofing vulnerability in opa plugin.
An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin.
This could allow the attacker to assume higher privileges on the upstream service.
This issue affects Apache APISIX: from 3.5.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Published: 2026-06-19T13:14:52.100Z
Updated: 2026-06-22T16:20:09.284Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49230 |
vulnerable | 2026-07-29 00:57:45.290996 |
Apache APISIX: Authentication bypass in jwe-decrypt
Improper Validation of Integrity Check Value vulnerability in Apache APISIX.
The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass.
This issue affects Apache APISIX: from 3.8.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Published: 2026-06-19T13:13:38.841Z
Updated: 2026-06-22T16:19:42.049Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48895 |
vulnerable | 2026-07-29 00:55:01.759526 |
Apache APISIX: Cas-auth Host header influence on CAS service URL
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.
The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token.
This issue affects Apache APISIX: from 3.0.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Published: 2026-06-19T13:16:29.442Z
Updated: 2026-06-22T16:20:39.998Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47341 |
vulnerable | 2026-07-29 00:55:00.121243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47339 |
vulnerable | 2026-07-29 00:55:00.119776 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44915 |
vulnerable | 2026-07-29 00:52:14.917389 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44087 |
vulnerable | 2026-07-29 00:52:14.046084 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44046 |
vulnerable | 2026-07-29 00:52:14.035290 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39999 |
vulnerable | 2026-07-29 00:46:19.644621 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39998 |
vulnerable | 2026-07-29 00:46:19.644431 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31924 |
vulnerable | 2026-06-08 07:57:16.106945 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31923 |
vulnerable | 2026-06-08 07:57:16.106542 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31908 |
vulnerable | 2026-06-08 07:57:16.091346 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62232 |
vulnerable | 2026-06-08 07:37:28.928412 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46647 |
vulnerable | 2026-06-08 07:27:08.564415 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32638 |
vulnerable | 2026-06-08 06:37:23.483160 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29266 |
vulnerable | 2026-06-08 05:42:47.519250 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25757 |
vulnerable | 2026-06-08 05:41:49.381365 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24112 |
vulnerable | 2026-06-08 05:40:59.627384 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43557 |
vulnerable | 2026-06-08 05:36:43.550533 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13945 |
vulnerable | 2026-06-08 05:18:01.569093 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.