CVE-2026-63041: Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
Published Aug 26, 2026
·Updated
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX.
This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly.
This issue affects Apache APISIX: from 3.11.0 through 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected Software
2 affected components
Apache APISIX>=3.11.0<3.17.0
Apache APISIX>=3.18.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Aug 26, 2026
CVE Published
via MITRE·11:34 AM
Data Sourced
via MITRE·11:34 AM
DescriptionWeakness