CVE-2026-63041: Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX.
This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly.
This issue affects Apache APISIX: from 3.11.0 through 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache APISIX versions 3.11.0 through 3.17.0 are affected. The issue specifically involves the attach-consumer-label plugin.
What must an attacker do to exploit the vulnerability?
An attacker must send certain client-controlled consumer-label header values that are not correctly sanitised by the attach-consumer-label plugin. Successful exploitation can result in privilege escalation or an authorization bypass.
What is the recommended remediation?
Upgrade Apache APISIX to version 3.18.0, which fixes the issue.