https://seclists.org/oss-sec/2026/q4/3: CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth

Q: Which deployments are exposed?

Apache APISIX versions 3.17.0 through 3.18.0 are affected when routes are protected by the saml-auth plugin. The issue is exploitable under the plugin's default configuration.

Q: Does an attacker need an existing account or user interaction?

No. The issue allows an unauthenticated attacker to impersonate any user on affected routes, without user interaction.

Q: What is the recommended remediation?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.

Q: How can I identify whether my deployment is affected?

Check whether APISIX is running a version from 3.17.0 through 3.18.0 and whether any routes use the saml-auth plugin with its default configuration.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache APISIX>=3.17.0<=3.18.0

Frequently Asked Questions

Which deployments are exposed?

Apache APISIX versions 3.17.0 through 3.18.0 are affected when routes are protected by the saml-auth plugin. The issue is exploitable under the plugin's default configuration.

Does an attacker need an existing account or user interaction?

No. The issue allows an unauthenticated attacker to impersonate any user on affected routes, without user interaction.

What is the recommended remediation?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.

How can I identify whether my deployment is affected?

Check whether APISIX is running a version from 3.17.0 through 3.18.0 and whether any routes use the saml-auth plugin with its default configuration.