CVE-2026-124716: Apache APISIX: authz-keycloak authorization scope mismatch
Incorrect Authorization vulnerability in Apache APISIX.
An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.
This issue affects Apache APISIX: from 1.4.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.20.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache APISIX versions 1.4.0 through 3.19.0 are affected where routes use the authz-keycloak authorization functionality with multiple required permissions or scopes.
What does an attacker need to exploit the authorization bypass?
The attacker must be an authenticated user with any one permission or scope required by a protected route. They can then reach the upstream even if they lack the route's other required permissions or scopes, including for HTTP methods denied by the authorization server.
Is there a fix available?
Yes. Upgrade Apache APISIX to version 3.20.0, which fixes the issue.