Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-124719

Apache APISIX: identity spoofing in openapi-to-mcp

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache APISIX

Default version status: unaffected

  • 3.19.0 to < 3.20.0affected
pkg:software-id/apache.org/apisix

References