CVE-2026-124719: Apache APISIX: identity spoofing in openapi-to-mcp

Q: Which deployments are exposed to this issue?

Apache APISIX versions from 3.19.0 before 3.20.0 are affected when a Route is configured with headers that carry caller identity and its OpenAPI document declares the same header.

Q: What does an attacker need to exploit it?

The attacker needs to be able to send requests through an affected Route and spoof a header that is both used as caller identity by the Route configuration and declared in the OpenAPI document. No user interaction is required.

Q: What is the impact of successful exploitation?

A caller can act as another identity when accessing the upstream API. The provided severity vector indicates the impact is limited to subsequent-system confidentiality and integrity, with no stated availability impact.

Q: What should teams do if they cannot upgrade immediately?

The provided information recommends upgrading to Apache APISIX 3.20.0. No alternative mitigation is specified; prioritize reviewing Routes where identity-carrying configured headers overlap with headers declared by their OpenAPI documents.

Published Nov 13, 2026

Updated

Authentication bypass by spoofing vulnerability in Apache APISIX.

When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Affected Software

1 affected component

Apache Apache APISIX>=3.19.0<3.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache APISIX to a version that resolves this vulnerability.
Fixed in 3.20.0

Event History

Nov 13, 2026

CVE Published

via MITRE·05:50 PM

Data Sourced

via MITRE·05:50 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache APISIX versions from 3.19.0 before 3.20.0 are affected when a Route is configured with headers that carry caller identity and its OpenAPI document declares the same header.

What does an attacker need to exploit it?

The attacker needs to be able to send requests through an affected Route and spoof a header that is both used as caller identity by the Route configuration and declared in the OpenAPI document. No user interaction is required.

What is the impact of successful exploitation?

A caller can act as another identity when accessing the upstream API. The provided severity vector indicates the impact is limited to subsequent-system confidentiality and integrity, with no stated availability impact.

What should teams do if they cannot upgrade immediately?

The provided information recommends upgrading to Apache APISIX 3.20.0. No alternative mitigation is specified; prioritize reviewing Routes where identity-carrying configured headers overlap with headers declared by their OpenAPI documents.

CVE-2026-124719: Apache APISIX: identity spoofing in openapi-to-mcp

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should teams do if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should teams do if they cannot upgrade immediately?