Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder
Developer API

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Careers
Contact
Book a demo

Get Started

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Log in Start free

Home
Vendors
Apache
Apisix

Apache Software Foundation apisix Vulnerabilities: CVEs, CISA KEV & Security Advisories

Apache Software Foundation

25 CVEs

2 in CISA KEV

Apache Software Foundation apisix Vulnerabilities

CVE security advisories and vulnerability history for apisix by Apache Software Foundation.

25

Total CVEs

Published

2

In CISA KEV

Exploited in the wild

4

Public exploits

PoC or exploit code

5.9

Avg CVSS

2020–2026

Last updated June 19, 2026

Overview

Apache Software Foundation apisix has 25 published CVE records since 2020, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 5.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation apisix, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation apisix's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical3

High6

Medium11

Low5

In CISA’s Known Exploited Vulnerabilities catalog

2

2 of Apache Software Foundation apisix's CVEs are confirmed exploited in the wild.

Public exploits

4

4 of Apache Software Foundation apisix's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation apisix version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

0.27 CVEs
0.37 CVEs
0.3-17 CVEs
0.47 CVEs
0.4.17 CVEs
0.57 CVEs
0.77 CVEs
0.97 CVEs
0.9-RC17 CVEs
3.8.04 CVEs
3.9.04 CVEs
3.2.03 CVEs
3.6.03 CVEs
3.7.03 CVEs
2.10.02 CVEs
2.10.12 CVEs
2.10.21 CVE
2.10.31 CVE
2.12.01 CVE
2.13.01 CVE

Version ranges

3.0.0 <= v < 3.17.04 CVEs
< 2.10.21 CVE
< 2.10.41 CVE
< 2.13.01 CVE
< 2.13.11 CVE
< 3.12.01 CVE
< 3.6.11 CVE
0.2 <= v <= 0.51 CVE
0.7 <= v < 3.16.01 CVE
1.0 <= v < 3.14.01 CVE
1.2 <= v < 3.17.01 CVE
1.2 <= v <= 1.51 CVE
2.11.0 <= v < 2.12.11 CVE
2.12.0 <= v < 3.16.0

Fixed in

3.17.012 CVEs
9ef2ecab67f652d38365049613610ef649bb4ad012 CVEs
3.16.03 CVEs
f9c4ee37170bdfe075c846973c1be65a582a0c4f3 CVEs
19587ed9f71dd20c5e8dbdc2f79c8f96296e73e31 CVE
2.10.21 CVE
2.10.41 CVE
2.12.11 CVE
2.13.01 CVE
2.13.11 CVE
3.12.01 CVE
3.14.01 CVE
3.6.11 CVE

Find a version

25 CVEs

Sort

Apache APISIX: Improper authentication in cas-auth plugin
CVE-2026-49872
Patch
CWE-287
Medium · CVSS 5.3
EPSS 0.3% (24th pct)2026-06-19
Apache APISIX: cas-auth login CSRF / session injection issue
CVE-2026-49871
Patch
CWE-352
Low · CVSS 2.1
EPSS 0.3% (18th pct)2026-06-19
Apache APISIX: Session replay issue in hmac-auth
CVE-2026-47341
Patch
CWE-294
Medium · CVSS 6.3
EPSS 0.4% (35th pct)2026-06-19
Apache APISIX: Cas-auth Host header influence on CAS service URL
CVE-2026-48895
Patch
CWE-601
Low · CVSS 2.1
EPSS 0.4% (34th pct)2026-06-19
Apache APISIX: Identity spoofing issue in APISIX opa plugin
CVE-2026-49231
Patch
CWE-290
Low · CVSS 2.3
EPSS 0.4% (29th pct)2026-06-19
Apache APISIX: Authentication bypass in jwe-decrypt
CVE-2026-49230
Patch
CWE-354
Medium · CVSS 6.3
EPSS 0.2% (13th pct)2026-06-19
Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
CVE-2026-44915
Patch
CWE-601
Low · CVSS 2.1
EPSS 0.4% (33th pct)2026-06-19
Apache APISIX: Openid-connect plugin Identity Header Spoofing
CVE-2026-44087
Patch
CWE-345
Medium · CVSS 5.3
EPSS 0.2% (12th pct)2026-06-19
Apache APISIX: authz-casdoor incorrect session sharing
CVE-2026-47339
Patch
CWE-863
Medium · CVSS 5.3
EPSS 0.3% (21th pct)2026-06-19
Apache APISIX: wolf-rbac plugin Identity Spoofing
CVE-2026-44046
Patch
CWE-348
Low · CVSS 2.3
EPSS 0.3% (24th pct)2026-06-19
Apache APISIX: JWT Algorithm Confusion allows authentication bypass
CVE-2026-39999
Patch
CWE-290
High · CVSS 7.0
EPSS 0.4% (35th pct)2026-06-19
Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup
CVE-2026-39998
Patch
CWE-20
Medium · CVSS 5.8
EPSS 0.4% (33th pct)2026-06-19
Apache APISIX: Openid-connect `tls_verify` field is disabled by default
CVE-2026-31923
Patch
CWE-319
High · CVSS 7.5
EPSS 0.3% (16th pct)2026-04-14
Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
CVE-2026-31924
Patch
CWE-319
Medium · CVSS 5.3
EPSS 0.2% (15th pct)2026-04-14
Apache APISIX: forward auth plugin allows header injection
CVE-2026-31908
Patch
CWE-75
Critical · CVSS 9.1
EPSS 0.5% (41th pct)2026-04-14
Apache APISIX: basic-auth logs plaintext credentials at info level
CVE-2025-62232
Patch
CWE-532
High · CVSS 7.5
EPSS 0.4% (36th pct)2025-10-31
Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges
CVE-2025-27446
Patch
CWE-732
High · CVSS 7.8
EPSS 0.2% (7th pct)2025-07-06
Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect
CVE-2025-46647
Patch
CWE-302
Medium · CVSS 5.3
EPSS 0.4% (35th pct)2025-07-02
Medium vulnerability · 2024-05-02
CVE-2024-32638
Patch
CWE-444
Medium · CVSS 6.3
EPSS 1.1% (61th pct)2024-05-02
Medium vulnerability · 2023-10-10
CVE-2023-44487
CISA KEV
Public exploit
Patch
CWE-400
Added to CISA KEV 2023-10-10
Medium · CVSS 6.9
EPSS 100.0% (100th pct)2023-10-10
High vulnerability · 2022-04-20
CVE-2022-29266
Patch
Workaround
CWE-209
High · CVSS 7.5
EPSS 7.8% (94th pct)2022-04-20
Critical vulnerability · 2022-03-28
CVE-2022-25757
Patch
Workaround
CWE-20
Critical · CVSS 9.8
EPSS 2.4% (82th pct)2022-03-28
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
CVE-2022-24112
CISA KEV
Public exploit
Patch
Workaround
CWE-290
Added to CISA KEV 2022-08-25
Critical · CVSS 9.3
EPSS 96.2% (100th pct)2022-02-11
High vulnerability · 2021-11-22
CVE-2021-43557
Public exploit
Patch
Workaround
High · CVSS 7.5
EPSS 14.6% (96th pct)2021-11-22
Medium vulnerability · 2020-12-07
CVE-2020-13945
Public exploit
Patch
Medium · CVSS 6.5
EPSS 73.0% (99th pct)2020-12-07

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation apisix CVEs. Follow any weakness for its full explanation.

CWE-290Authentication Bypass by Spoofing3 CVEs
CWE-319Cleartext Transmission of Sensitive Information2 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')2 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-302Authentication Bypass by Assumed-Immutable Data1 CVE
CWE-287Improper Authentication1 CVE
CWE-345Insufficient Verification of Data Authenticity1 CVE
CWE-294Authentication Bypass by Capture-replay1 CVE

Disclosure activity by year

How many Apache Software Foundation apisix CVEs were published each year.

2020

1

2021

1

2022

3

2023

1

2024

1

2025

3

2026

15

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server351 CVEs tomcat265 CVEs airflow183 CVEs Apache Airflow136 CVEs apache-airflow127 CVEs Apache HTTP Server125 CVEs httpd125 CVEs org.apache.tomcat:tomcat118 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation apisix vulnerabilities.

How many CVEs does Apache Software Foundation apisix have?: Apache Software Foundation apisix has 25 published CVE records since 2020.
How many Apache Software Foundation apisix CVEs are in CISA KEV?: Yes — 2 of Apache Software Foundation apisix's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Apache Software Foundation apisix vulnerabilities?: Yes — 4 of Apache Software Foundation apisix's CVEs have a known public exploit.
Which versions of Apache Software Foundation apisix are affected?: 63 distinct Apache Software Foundation apisix versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation apisix CVEs?: Apache Software Foundation apisix's CVEs most often map to these CWE weakness types: CWE-290 (Authentication Bypass by Spoofing), CWE-319 (Cleartext Transmission of Sensitive Information), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-20 (Improper Input Validation).
How many critical Apache Software Foundation apisix vulnerabilities are there?: Apache Software Foundation apisix has 3 critical and 6 high-severity CVEs.
What is the average severity of Apache Software Foundation apisix CVEs?: The average CVSS base score across Apache Software Foundation apisix's scored CVEs is 5.9.

References

All Apache Software Foundation vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation apisix vulnerabilities

Monitor new Apache Software Foundation apisix vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References

1 CVE

2.12.0 <= v < 3.17.01 CVE

2.14.1 <= v < 3.17.01 CVE

2.2 <= v < 3.17.01 CVE

2.3 <= v < 3.17.01 CVE

2.99.0 <= v < 3.16.01 CVE

3.11.0 <= v < 3.17.01 CVE

3.5.0 <= v < 3.17.01 CVE

3.8.0 <= v < 3.17.01 CVE

3.8.0 <= v <= 3.8.01 CVE

3.9.0 <= v <= 3.9.01 CVE

75d94c051fc940a174fbdba4ce0588c13fecf864

1 CVE

a22336785ce98edd19c5b7f1d2beee990d6141231 CVE

c89d39cf3e7ccc333e1c7b74b1097a09f2f1ef871 CVE

d4e658fed1fb998e3301597f663a7fa9cd1d15c31 CVE

f118f5ea7a5d96023a7bd546545f7c1ad64864951 CVE

f43a20e587e3494cbc924278ad317bf98cfa32011 CVE