CVE-2026-31924: Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31924?
CVE-2026-31924 has a medium severity due to the risk of plaintext transmission of sensitive information.
How do I fix CVE-2026-31924?
To fix CVE-2026-31924, users should upgrade Apache APISIX to version 3.15.1 or later.
What versions of Apache APISIX are affected by CVE-2026-31924?
CVE-2026-31924 affects Apache APISIX versions from 2.99.0 up to 3.15.0.
What is the main problem caused by CVE-2026-31924?
The main problem caused by CVE-2026-31924 is the use of plaintext HTTP which can expose sensitive information.
What component of Apache APISIX does CVE-2026-31924 involve?
CVE-2026-31924 involves the tencent-cloud-cls log export plugin in Apache APISIX.