https://seclists.org/oss-sec/2026/q4/6: CVE-2026-94269: Apache APISIX: Servlet-style normalization cates a route/upstam authorization mismatch

Q: Which deployments are exposed to this issue?

Apache APISIX versions 2.14.1 through 3.18.0 are affected when a permissive route overlaps a protected route. The issue depends on this route configuration condition.

Q: What does an attacker need to exploit it?

An unauthenticated attacker can send a crafted encoded URL path. Exploitation relies on the path causing a route and upstream authorization mismatch.

Q: What is the recommended remediation?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache APISIX>=2.14.1<=3.18.0

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache APISIX versions 2.14.1 through 3.18.0 are affected when a permissive route overlaps a protected route. The issue depends on this route configuration condition.

What does an attacker need to exploit it?

An unauthenticated attacker can send a crafted encoded URL path. Exploitation relies on the path causing a route and upstream authorization mismatch.

What is the recommended remediation?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.