{"id":"CVE-2026-124680","kind":"vulnerability","aliases":["CVE-2026-124680"],"related":[],"title":"Apache APISIX: encoded dot segments let clients skip route auth plugins","description":"Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.\n\n\n\nAn unauthenticated client can reach upstream paths protected\nby a route-level auth plugin when a route without auth exists on the\nsame upstream and the upstream does not collapse encoded dot segments.\n\n\n\nThis issue affects Apache APISIX: from 0.9 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue.","summary":"Apache APISIX can let an unauthenticated client reach upstream paths that a route-level auth plugin should protect, when a route without auth shares the same upstream. The flaw is an incorrect authorization caused by how encoded dot segments in request paths are interpreted.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-apisix","api-gateway","infrastructure","self-hosted"],"not_affected_if":["single-route-per-upstream","upstream-collapses-dot-segments"],"how_to_check":"- Check the APISIX version with `apisix version` or the image tag; affected versions run from 0.9 through `3.19.0`.\n- List routes that share an upstream and look for one route with an auth plugin and another without it.\n- Check whether the upstream collapses encoded dot segments (`%2e%2e`); the sources do not say how to test this.","fix":"- Upgrade Apache APISIX to `3.20.0` or later.","status":"open","published_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:37+00:00","updated_at":"2026-11-13T18:51:37+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T18:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache APISIX to `3.20.0` or later.","reach":"internet","title":"Apache APISIX: encoded dot segments let clients skip route auth plugins","impact":"high","summary":"Apache APISIX can let an unauthenticated client reach upstream paths that a route-level auth plugin should protect, when a route without auth shares the same upstream. The flaw is an incorrect authorization caused by how encoded dot segments in request paths are interpreted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["apache-apisix","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients reach upstream paths behind auth plugins","analyst_note":"Confirm the exact affected configuration and whether the fix is only 3.20.0 in the Apache advisory; the sources give no test method.","how_to_check":"- Check the APISIX version with `apisix version` or the image tag; affected versions run from 0.9 through `3.19.0`.\n- List routes that share an upstream and look for one route with an auth plugin and another without it.\n- Check whether the upstream collapses encoded dot segments (`%2e%2e`); the sources do not say how to test this.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-route-per-upstream","upstream-collapses-dot-segments"],"who_is_affected":"Teams running Apache APISIX as an API gateway where one upstream is reachable through both an authenticated route and an unauthenticated route. Deployments where every route to an upstream carries the same auth plugin, or where the upstream collapses encoded dot segments, are less exposed. The sources do not give more detail on the exact conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4612,"output_tokens":662,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124680':14A,17A '-2026':13A,16A '0.9':123C '3.19.0':125C '3.20.0':133C 'affect':119C 'apach':1A,19B,28B,81C,120C 'apache-apisix':18B 'api':22B 'api-gateway':21B 'apisix':2A,20B,29B,82C,121C 'auth':10A,43B,51B,96C,102C 'author':61B,78C 'caus':62B 'client':7A,34B,85C 'collaps':113C 'conflict':74C 'cve':12A,15A 'dot':4A,66B,115C 'encod':3A,65B,114C 'exist':103C 'fix':135C 'flaw':57B 'gateway':23B 'host':27B 'incorrect':60B,77C 'infrastructur':24B 'interpret':72B,73C 'issu':118C,137C 'let':6A,31B 'level':42B,95C 'path':37B,70B,89C 'plugin':11A,44B,97C 'protect':46B,90C 'reach':35B,87C 'recommend':128C 'request':69B 'result':75C 'rout':9A,41B,49B,94C,100C 'route-level':40B,93C 'segment':5A,67B,116C 'self':26B 'self-host':25B 'share':52B 'skip':8A 'unauthent':33B,84C 'upgrad':130C 'upstream':36B,55B,88C,107C,110C 'user':126C 'version':132C 'vulner':79C 'without':50B,101C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache APISIX as an API gateway where one upstream is reachable through both an authenticated route and an unauthenticated route. Deployments where every route to an upstream carries the same auth plugin, or where the upstream collapses encoded dot segments, are less exposed. The sources do not give more detail on the exact conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheapisix","apigateway","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-124680':14A,17A '-2026':13A,16A 'apach':1A 'apisix':2A 'auth':10A 'client':7A 'cve':12A,15A 'dot':4A 'encod':3A 'let':6A 'plugin':11A 'rout':9A 'segment':5A 'skip':8A","search_b":"'apach':19B,28B 'apache-apisix':18B 'api':22B 'api-gateway':21B 'apisix':20B,29B 'auth':43B,51B 'author':61B 'caus':62B 'client':34B 'dot':66B 'encod':65B 'flaw':57B 'gateway':23B 'host':27B 'incorrect':60B 'infrastructur':24B 'interpret':72B 'let':31B 'level':42B 'path':37B,70B 'plugin':44B 'protect':46B 'reach':35B 'request':69B 'rout':41B,49B 'route-level':40B 'segment':67B 'self':26B 'self-host':25B 'share':52B 'unauthent':33B 'upstream':36B,55B 'without':50B","search_c":"'0.9':123C '3.19.0':125C '3.20.0':133C 'affect':119C 'apach':81C,120C 'apisix':82C,121C 'auth':96C,102C 'author':78C 'client':85C 'collaps':113C 'conflict':74C 'dot':115C 'encod':114C 'exist':103C 'fix':135C 'incorrect':77C 'interpret':73C 'issu':118C,137C 'level':95C 'path':89C 'plugin':97C 'protect':90C 'reach':87C 'recommend':128C 'result':75C 'rout':94C,100C 'route-level':93C 'segment':116C 'unauthent':84C 'upgrad':130C 'upstream':88C,107C,110C 'user':126C 'version':132C 'vulner':79C 'without':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124680","severity":null,"published_at":"2026-11-13T18:17:31+00:00","modified_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}