Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache APISIX

34 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-31908 Public exploit

    Apache APISIX: forward auth plugin allows header injection

    Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to ver…

    Apache Software Foundation Apache APISIX
  • Critical 9.8
    CVE-2022-24112 Exploited Public exploit EPSS 96%

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…

    Apache Software Foundation Apache APISIX
    KEV Aug 25, 2022