{"id":"CVE-2026-124726","state":"PUBLISHED","title":"Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare","description":"Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.\n\n\n\nA caller of the MCP endpoint can invoke endpoints the OpenAPI document\nnever declared, under the declared tool's HTTP method, using the credentials the\nRoute adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue.","publishedAt":"2026-11-13T17:49:21.949Z","updatedAt":"2026-11-13T23:05:05.191Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","source":"apache"},"assigner":"apache","products":["Apache Software Foundation Apache APISIX"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache APISIX","packageURL":"pkg:software-id/apache.org/apisix","defaultStatus":"unaffected","versions":[{"version":"3.19.0","status":"affected","lessThan":"3.20.0","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/1kodokhflvr51sc1qv985om3s6mozybg","http://www.openwall.com/lists/oss-security/2026/11/13/11"],"weaknesses":["CWE-23"],"ingestedAt":"2026-11-13T23:12:05.958Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/124xxx/CVE-2026-124726.json","commit":"47d831e1635176ecfe0915ea00703ec3e13005f4","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-124726","state":"PUBLISHED","datePublished":"2026-11-13T17:49:21.949Z","dateUpdated":"2026-11-13T23:05:05.191Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-11-09T11:18:05.786Z"},"containers":{"cna":{"title":"Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare","descriptions":[{"lang":"en","value":"Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.\n\n\n\nA caller of the MCP endpoint can invoke endpoints the OpenAPI document\nnever declared, under the declared tool's HTTP method, using the credentials the\nRoute adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache APISIX","packageURL":"pkg:software-id/apache.org/apisix","defaultStatus":"unaffected","versions":[{"version":"3.19.0","status":"affected","lessThan":"3.20.0","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/1kodokhflvr51sc1qv985om3s6mozybg","tags":["vendor-advisory"]}],"metrics":[{"scenarios":[{"lang":"en","value":"GENERAL"}],"format":"CVSS","cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","description":"CWE-23: Relative Path Traversal, with CWE-441: Unintended Proxy or Intermediary","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-11-13T17:49:21.949Z"},"source":{"discovery":"UNKNOWN"},"credits":[{"lang":"en","value":"Javier García Herrera","type":"reporter"},{"lang":"en","value":"shreemaan-abhishek","type":"coordinator"},{"lang":"en","value":"shreemaan-abhishek","type":"remediation developer"}],"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-13T19:49:40.828881Z","id":"CVE-2026-124726","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-11-13T20:02:35.162Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/13/11"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-11-13T23:05:05.191Z"}}]}}}