CVE-2026-124723: Apache APISIX: unauthorized access to mTLS protected resources

Q: Which deployments are exposed to this issue?

Apache APISIX deployments running versions 3.18.0 through 3.19.0 are affected only when both match_uri_encoded_slash is enabled and skip_mtls_uri_regex is configured. The reachable upstream paths are limited to paths that decode to a URI exempted by the configured regex.

Q: What does an attacker need to exploit the issue?

An attacker can be a client without a certificate. They need to send a request path whose encoded form is handled by the route but whose decoded form matches a URI exempted through skip_mtls_uri_regex.

Q: Is a default Apache APISIX configuration affected?

The issue requires match_uri_encoded_slash to be enabled and skip_mtls_uri_regex to be configured. The provided information does not establish whether those settings are enabled by default.

Q: What should teams do to remediate this issue?

Upgrade Apache APISIX to version 3.20.0, which fixes the issue. Until upgrading, review whether match_uri_encoded_slash is enabled together with skip_mtls_uri_regex and assess mTLS-protected routes for decoded paths that match configured exemptions.

Published Nov 13, 2026

Updated

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.

With matchuriencodedslash enabled and skipmtlsuriregex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Affected Software

1 affected component

Apache APISIX>=3.18.0<=3.19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache APISIX to a version that resolves this vulnerability.
Fixed in 3.20.0

Event History

Nov 13, 2026

CVE Published

via MITRE·05:49 PM

Data Sourced

via MITRE·05:49 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache APISIX deployments running versions 3.18.0 through 3.19.0 are affected only when both match_uri_encoded_slash is enabled and skip_mtls_uri_regex is configured. The reachable upstream paths are limited to paths that decode to a URI exempted by the configured regex.

What does an attacker need to exploit the issue?

An attacker can be a client without a certificate. They need to send a request path whose encoded form is handled by the route but whose decoded form matches a URI exempted through skip_mtls_uri_regex.

Is a default Apache APISIX configuration affected?

The issue requires match_uri_encoded_slash to be enabled and skip_mtls_uri_regex to be configured. The provided information does not establish whether those settings are enabled by default.

What should teams do to remediate this issue?

Upgrade Apache APISIX to version 3.20.0, which fixes the issue. Until upgrading, review whether match_uri_encoded_slash is enabled together with skip_mtls_uri_regex and assess mTLS-protected routes for decoded paths that match configured exemptions.

CVE-2026-124723: Apache APISIX: unauthorized access to mTLS protected resources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

Is a default Apache APISIX configuration affected?

What should teams do to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

Is a default Apache APISIX configuration affected?

What should teams do to remediate this issue?