CVE-2026-124666: Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

Q: Which deployments are exposed to this issue?

Deployments running Apache APISIX versions 3.8.0 through 3.19.0 are affected when a route uses multi-auth, falls back from wolf-rbac to another successful authenticator, and a downstream service relies on Wolf identity headers.

Q: What does an attacker need to do to exploit it?

The attacker needs to supply Wolf identity headers in a request to an affected multi-auth route. If wolf-rbac falls back and another authenticator succeeds, those client-provided headers can reach the downstream service as an identity that was not established by the successful authenticator.

Q: Are all APISIX routes affected by default?

The issue is described for routes configured with multi-auth that can fall back from wolf-rbac to another authenticator. Impact additionally depends on a downstream service trusting the documented Wolf identity headers.

Q: How should affected installations be remediated?

Upgrade Apache APISIX to version 3.20.0, which fixes the issue.

Published Nov 13, 2026

Updated

Authentication bypass by spoofing vulnerability in Apache APISIX.

On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.

This issue affects Apache APISIX: from 3.8.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Affected Software

1 affected component

Apache APISIX>=3.8.0<=3.19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache APISIX to a version that resolves this vulnerability.
Fixed in 3.20.0

Event History

Nov 13, 2026

CVE Published

via MITRE·05:52 PM

Data Sourced

via MITRE·05:52 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running Apache APISIX versions 3.8.0 through 3.19.0 are affected when a route uses multi-auth, falls back from wolf-rbac to another successful authenticator, and a downstream service relies on Wolf identity headers.

What does an attacker need to do to exploit it?

The attacker needs to supply Wolf identity headers in a request to an affected multi-auth route. If wolf-rbac falls back and another authenticator succeeds, those client-provided headers can reach the downstream service as an identity that was not established by the successful authenticator.

Are all APISIX routes affected by default?

The issue is described for routes configured with multi-auth that can fall back from wolf-rbac to another authenticator. Impact additionally depends on a downstream service trusting the documented Wolf identity headers.

How should affected installations be remediated?

Upgrade Apache APISIX to version 3.20.0, which fixes the issue.

CVE-2026-124666: Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

Are all APISIX routes affected by default?

How should affected installations be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

Are all APISIX routes affected by default?

How should affected installations be remediated?