Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

Apache APISIX may let unauthorized users reach protected services

CVE-2026-94269 · published 1 month ago
Summary

Apache APISIX versions from 2.14.1 up to 3.18.0 can treat specially crafted URLs as valid, allowing requests to bypass the intended access controls and reach back‑end services they shouldn't. This means an attacker could access protected resources without authentication. Upgrade to version 3.19.0 or later to resolve the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apache software foundation apache apisix <= 3.18.0
Original advisory text
Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.



In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0.



Users are recommended to upgrade to version 3.19.0, which fixes the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-647Use of Non-Canonical URL Paths for Authorization Decisions
Timeline
Published1 Oct 2026
Updated3 Nov 2026
First seen1 Oct 2026
Sources
CVE-2026-94269 · NVD
CVE-2026-94269 · MITRE
Track software like this
Free during beta