CVE Tools
Track your stack

Apache Apisix

34 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Apache Apisix, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Apisix CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Apisix CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-101
2025-110
2025-120
2026-010
2026-020
2026-030
2026-043
2026-050
2026-0612
2026-070
2026-084
2026-090
2026-107

Severity

How the 34 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical726%
  • High1244%
  • Medium830%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Apisix.

  1. CVE-2026-94276Apache APISIX: Openid-connect introspection validation issue—
  2. CVE-2026-94269Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch—
  3. CVE-2026-94250Apache APISIX: Batch response aggregation can exhaust worker memory—
  4. CVE-2026-94220Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin—
  5. CVE-2026-94212Apache APISIX: unauthenticated impersonation issue in saml-auth—
  6. CVE-2026-82806Apache APISIX: cross-request permission pollution via static permission list mutation—
  7. CVE-2026-78242Apache APISIX: data-mask may fail to redact request headers in logger output—
  8. CVE-2026-74848Apache APISIX: Cross-user response poisoning in serverless plugins7.5
  9. CVE-2026-75005Apache APISIX: Unauthenticated CPU-exhaustion DoS7.5
  10. CVE-2026-75020Apache APISIX: ldap-auth plugin cross-subtree identity impersonation8.1
  11. CVE-2026-63041Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers8.8
  12. CVE-2026-49872Apache APISIX: Improper authentication in cas-auth plugin8.1
  13. CVE-2026-49871Apache APISIX: cas-auth login CSRF / session injection issue9.3
  14. CVE-2026-47341Apache APISIX: Session replay issue in hmac-auth6.5
  15. CVE-2026-48895Apache APISIX: Cas-auth Host header influence on CAS service URL7.2

Product grouping is registry-driven, with AI assist and human review. How it works