https://seclists.org/oss-sec/2026/q4/2: CVE-2026-82806: Apache APISIX: cross-quest permission pollution via static permission list mutation

Q: Which deployments are exposed to this issue?

Apache APISIX versions from 2.3.0 up to, but not including, 3.7.0 are affected when using a supported authz-keycloak configuration. The issue concerns requests handled on the same route.

Q: What does an attacker need to exploit the problem?

The CVSS vector indicates network reachability, low attack complexity, no user interaction, and privileges required. The vulnerability involves authorization scope from one request persisting into later requests on the same route.

Q: What is the remediation?

Upgrade Apache APISIX to version 3.7.0 or later. Version 3.7.0 fixes the static permission-list mutation that can cause authorization expansion and inconsistent access-control decisions.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache APISIX>=2.3.0<3.7.0

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache APISIX versions from 2.3.0 up to, but not including, 3.7.0 are affected when using a supported authz-keycloak configuration. The issue concerns requests handled on the same route.

What does an attacker need to exploit the problem?

The CVSS vector indicates network reachability, low attack complexity, no user interaction, and privileges required. The vulnerability involves authorization scope from one request persisting into later requests on the same route.

What is the remediation?

Upgrade Apache APISIX to version 3.7.0 or later. Version 3.7.0 fixes the static permission-list mutation that can cause authorization expansion and inconsistent access-control decisions.