Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-124723

Apache APISIX: unauthorized access to mTLS protected resources

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache APISIX

Default version status: unaffected

  • 3.18.0 to ≤ 3.19.0affected
pkg:software-id/apache.org/apisix

References