CVE-2026-124680 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Apache APISIX can let an unauthenticated client reach upstream paths that a route-level auth plugin should protect, when a route without auth shares the same upstream. The flaw is an incorrect authorization caused by how encoded dot segments in request paths are interpreted.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Apache APISIX as an API gateway where one upstream is reachable through both an authenticated route and an unauthenticated route. Deployments where every route to an upstream carries the same auth plugin, or where the upstream collapses encoded dot segments, are less exposed. The sources do not give more detail on the exact conditions.
Not affected if single-route-per-upstream, upstream-collapses-dot-segments
Who cares apache-apisix, api-gateway, self-hosted
apisix version or the image tag; affected versions run from 0.9 through 3.19.0.%2e%2e); the sources do not say how to test this.3.20.0 or later.Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.
An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments.
This issue affects Apache APISIX: from 0.9 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.