CVE-2026-124726: Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare
Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.
A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.20.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A caller of the MCP endpoint can exploit it. No privileges or user interaction are required according to the supplied severity vector, but exploitation requires a declared tool and use of that tool's HTTP method.
What is the impact of a successful exploit?
The caller can cause the openapi-to-mcp tool call to reach API paths that are not declared in the OpenAPI document. Requests are made using the credentials added by the APISIX Route, which can expose downstream endpoints through unintended proxying.
Are default deployments affected?
The available information identifies deployments using the MCP endpoint and openapi-to-mcp functionality, but does not state whether those features are enabled by default. Apache APISIX versions from 3.19.0 before 3.20.0 are affected.
What should teams do to remediate the issue?
Upgrade Apache APISIX to version 3.20.0, which fixes the issue. The provided information does not specify an alternative mitigation for environments that cannot upgrade immediately.