{"id":"CVE-2026-124723","kind":"vulnerability","aliases":["CVE-2026-124723"],"related":[],"title":"Apache APISIX: encoded slash lets clients skip mTLS certificate checks","description":"Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nWith match_uri_encoded_slash enabled and skip_mtls_uri_regex\nconfigured, a client without a certificate can reach an upstream\nbehind a route that requires one, limited to request paths that decode\nto an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue.","summary":"With match_uri_encoded_slash enabled and skip_mtls_uri_regex set, a client without a certificate can reach an upstream behind a route that requires one. The request path must decode to an exempted URI, which bypasses the mutual TLS requirement.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-apisix","api-gateway","infrastructure","mtls","self-hosted"],"not_affected_if":["default-config","match-uri-encoded-slash-disabled","no-mtls-routes"],"how_to_check":"- Check the APISIX version: `apisix version`, affected range is `3.18.0` through `3.19.0`\n- Look for `match_uri_encoded_slash` enabled and `skip_mtls_uri_regex` set in the APISIX configuration\n- Review routes that require client certificates for any exempted URI patterns","fix":"- Upgrade Apache APISIX to `3.20.0`","status":"open","published_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:44+00:00","updated_at":"2026-11-13T18:51:44+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T18:51:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache APISIX to `3.20.0`","reach":"internet","title":"Apache APISIX: encoded slash lets clients skip mTLS certificate checks","impact":"medium","summary":"With match_uri_encoded_slash enabled and skip_mtls_uri_regex set, a client without a certificate can reach an upstream behind a route that requires one. The request path must decode to an exempted URI, which bypasses the mutual TLS requirement.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["apache-apisix","api-gateway","mtls","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated clients reach upstream services behind client-certificate checks","analyst_note":"","how_to_check":"- Check the APISIX version: `apisix version`, affected range is `3.18.0` through `3.19.0`\n- Look for `match_uri_encoded_slash` enabled and `skip_mtls_uri_regex` set in the APISIX configuration\n- Review routes that require client certificates for any exempted URI patterns","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-mtls-routes","match-uri-encoded-slash-disabled"],"who_is_affected":"Only deployments running Apache APISIX 3.18.0 through 3.19.0 that enable match_uri_encoded_slash and configure skip_mtls_uri_regex on a route requiring client certificates. Deployments without both settings, or without mTLS routes, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4620,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124723':13A,16A '-2026':12A,15A '3.18.0':123C '3.19.0':125C '3.20.0':133C 'affect':119C 'apach':1A,18B,78C,120C 'apache-apisix':17B 'api':21B 'api-gateway':20B 'apisix':2A,19B,79C,121C 'author':75C 'behind':49B,101C 'bypass':65B 'certif':9A,44B,96C 'check':10A 'client':6A,41B,93C 'configur':91C 'conflict':71C 'cve':11A,14A 'decod':59B,112C 'enabl':33B,85C 'encod':3A,31B,83C 'exempt':62B,115C 'fix':135C 'gateway':22B 'host':27B 'incorrect':74C 'infrastructur':23B 'interpret':70C 'issu':118C,137C 'lead':72C 'let':5A 'limit':107C 'match':29B,81C 'mtls':8A,24B,36B,88C 'must':58B 'mutual':67B 'one':54B,106C 'path':57B,110C 'reach':46B,98C 'recommend':128C 'regex':38B,90C 'request':56B,109C 'requir':53B,69B,105C 'rout':51B,103C 'self':26B 'self-host':25B 'set':39B 'skip':7A,35B,87C 'slash':4A,32B,84C 'tls':68B 'upgrad':130C 'upstream':48B,100C 'uri':30B,37B,63B,82C,89C,116C 'user':126C 'version':132C 'vulner':76C 'without':42B,94C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running Apache APISIX 3.18.0 through 3.19.0 that enable match_uri_encoded_slash and configure skip_mtls_uri_regex on a route requiring client certificates. Deployments without both settings, or without mTLS routes, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheapisix","apigateway","infrastructure","medium","mtls","selfhosted"],"campaign_type":null,"search_a":"'-124723':13A,16A '-2026':12A,15A 'apach':1A 'apisix':2A 'certif':9A 'check':10A 'client':6A 'cve':11A,14A 'encod':3A 'let':5A 'mtls':8A 'skip':7A 'slash':4A","search_b":"'apach':18B 'apache-apisix':17B 'api':21B 'api-gateway':20B 'apisix':19B 'behind':49B 'bypass':65B 'certif':44B 'client':41B 'decod':59B 'enabl':33B 'encod':31B 'exempt':62B 'gateway':22B 'host':27B 'infrastructur':23B 'match':29B 'mtls':24B,36B 'must':58B 'mutual':67B 'one':54B 'path':57B 'reach':46B 'regex':38B 'request':56B 'requir':53B,69B 'rout':51B 'self':26B 'self-host':25B 'set':39B 'skip':35B 'slash':32B 'tls':68B 'upstream':48B 'uri':30B,37B,63B 'without':42B","search_c":"'3.18.0':123C '3.19.0':125C '3.20.0':133C 'affect':119C 'apach':78C,120C 'apisix':79C,121C 'author':75C 'behind':101C 'certif':96C 'client':93C 'configur':91C 'conflict':71C 'decod':112C 'enabl':85C 'encod':83C 'exempt':115C 'fix':135C 'incorrect':74C 'interpret':70C 'issu':118C,137C 'lead':72C 'limit':107C 'match':81C 'mtls':88C 'one':106C 'path':110C 'reach':98C 'recommend':128C 'regex':90C 'request':109C 'requir':105C 'rout':103C 'skip':87C 'slash':84C 'upgrad':130C 'upstream':100C 'uri':82C,89C,116C 'user':126C 'version':132C 'vulner':76C 'without':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124723","severity":null,"published_at":"2026-11-13T18:17:31+00:00","modified_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}