{"id":"CVE-2026-124726","kind":"vulnerability","aliases":["CVE-2026-124726"],"related":[],"title":"Apache APISIX: MCP caller can reach undeclared API endpoints with route credentials","description":"Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.\n\n\n\nA caller of the MCP endpoint can invoke endpoints the OpenAPI document\nnever declared, under the declared tool's HTTP method, using the credentials the\nRoute adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue.","summary":"Apache APISIX's MCP endpoint lets a caller reach API endpoints that the OpenAPI document never declared, using the HTTP method of a declared tool. The requests carry the credentials that the Route adds, so the caller gets access those credentials permit.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","apache-apisix","api-gateway","mcp"],"not_affected_if":["no-mcp-endpoint","version-outside-3.19.0-to-3.20.0"],"how_to_check":"- Check the Apache APISIX version with `apisix version` or the image tag; affected versions are from `3.19.0` before `3.20.0`.\n- Look for routes that expose the MCP endpoint and use the OpenAPI-to-MCP tool conversion, since those are the exposed path.","fix":"- Apache APISIX: upgrade to `3.20.0`.","status":"open","published_at":"2026-11-13T18:17:32+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:40+00:00","updated_at":"2026-11-13T18:51:40+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T18:51:40Z","model":"claude-haiku-5-5","output":{"fix":"- Apache APISIX: upgrade to `3.20.0`.","reach":"network","title":"Apache APISIX: MCP caller can reach undeclared API endpoints with route credentials","impact":"medium","summary":"Apache APISIX's MCP endpoint lets a caller reach API endpoints that the OpenAPI document never declared, using the HTTP method of a declared tool. The requests carry the credentials that the Route adds, so the caller gets access those credentials permit.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["apache-apisix","mcp","api-gateway"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"caller reaches undeclared endpoints with route credentials","analyst_note":"","how_to_check":"- Check the Apache APISIX version with `apisix version` or the image tag; affected versions are from `3.19.0` before `3.20.0`.\n- Look for routes that expose the MCP endpoint and use the OpenAPI-to-MCP tool conversion, since those are the exposed path.\n- unknown for anything beyond the version range.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-3.19.0-to-3.20.0","no-mcp-endpoint"],"who_is_affected":"Teams running Apache APISIX from 3.19.0 before 3.20.0 that expose an MCP endpoint built from an OpenAPI document, where Routes attach upstream credentials. Deployments without the MCP feature or on other versions are outside the stated range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4598,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124726':15A,18A '-2026':14A,17A '3.19.0':114C '3.20.0':116C,124C 'access':67B 'add':62B,107C 'affect':110C 'ai':20B 'ai-tool':19B 'apach':1A,23B,29B,79C,111C 'apache-apisix':22B 'api':8A,26B,38B 'api-gateway':25B 'apisix':2A,24B,30B,80C,112C 'caller':4A,36B,65B,82C 'carri':56B 'credenti':12A,58B,69B,104C 'cve':13A,16A 'declar':45B,52B,94C,97C 'document':43B,92C 'endpoint':9A,33B,39B,86C,89C 'fix':126C 'gateway':27B 'get':66B 'http':48B,100C 'invok':88C 'issu':109C,128C 'let':34B 'mcp':3A,28B,32B,85C 'method':49B,101C 'never':44B,93C 'openapi':42B,91C 'path':72C 'permit':70B 'proxi':76C 'reach':6A,37B 'recommend':119C 'relat':71C 'request':55B 'rout':11A,61B,106C 'tool':21B,53B,98C 'travers':73C 'undeclar':7A 'unintend':75C 'upgrad':121C 'use':46B,102C 'user':117C 'version':123C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache APISIX from 3.19.0 before 3.20.0 that expose an MCP endpoint built from an OpenAPI document, where Routes attach upstream credentials. Deployments without the MCP feature or on other versions are outside the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","apacheapisix","apigateway","mcp","medium"],"campaign_type":null,"search_a":"'-124726':15A,18A '-2026':14A,17A 'apach':1A 'api':8A 'apisix':2A 'caller':4A 'credenti':12A 'cve':13A,16A 'endpoint':9A 'mcp':3A 'reach':6A 'rout':11A 'undeclar':7A","search_b":"'access':67B 'add':62B 'ai':20B 'ai-tool':19B 'apach':23B,29B 'apache-apisix':22B 'api':26B,38B 'api-gateway':25B 'apisix':24B,30B 'caller':36B,65B 'carri':56B 'credenti':58B,69B 'declar':45B,52B 'document':43B 'endpoint':33B,39B 'gateway':27B 'get':66B 'http':48B 'let':34B 'mcp':28B,32B 'method':49B 'never':44B 'openapi':42B 'permit':70B 'reach':37B 'request':55B 'rout':61B 'tool':21B,53B 'use':46B","search_c":"'3.19.0':114C '3.20.0':116C,124C 'add':107C 'affect':110C 'apach':79C,111C 'apisix':80C,112C 'caller':82C 'credenti':104C 'declar':94C,97C 'document':92C 'endpoint':86C,89C 'fix':126C 'http':100C 'invok':88C 'issu':109C,128C 'mcp':85C 'method':101C 'never':93C 'openapi':91C 'path':72C 'proxi':76C 'recommend':119C 'relat':71C 'rout':106C 'tool':98C 'travers':73C 'unintend':75C 'upgrad':121C 'use':102C 'user':117C 'version':123C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124726","severity":null,"published_at":"2026-11-13T18:17:32+00:00","modified_at":"2026-11-13T18:17:32+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}