CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding
Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.
An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments.
This issue affects Apache APISIX: from 0.9 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.20.0
Event History
Frequently Asked Questions
Which deployments are exposed to this authentication bypass?
A deployment is exposed when it has both a route protected by a route-level authentication plugin and a route without authentication that forwards to the same upstream. Exploitation also requires that the upstream does not collapse encoded dot segments.
What does an attacker need to exploit the issue?
An attacker can be unauthenticated and does not require user interaction. They need network access to send requests that exploit the path-normalization mismatch between APISIX routing and upstream forwarding.
Are affected versions limited to a particular release branch?
The issue affects Apache APISIX versions from 0.9 through 3.19.0. Version 3.20.0 fixes the issue.
What should be done if an immediate upgrade is not possible?
Review routes sharing an upstream and identify cases where an unauthenticated route coexists with a route using route-level authentication. Restrict or remove the unauthenticated route exposure to the shared upstream where possible, especially when the upstream does not collapse encoded dot segments.