Skip to content
VulniPulse
Sign inStart free
Medium6.4Apache Software Foundation Updated

CVE-2026-124666: Authentication bypass by spoofing vulnerability in Apache APISIX

This Apache advisory covers CVE-2026-124666 in Apache APISIX.

Open the Apache advisory

Key facts

Vendor rating
Medium, CVSS 6.4
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N · base score 6.4, scored by apacheAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: low. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: high. Integrity impact on subsequent systems: high. Availability impact on subsequent systems: none.
Weakness
  • CWE-290 Authentication bypass by spoofing
CISA KEV
Not listed (catalogue checked )
Affected
3.8.0 through 3.19.0.; through 3.19.0
Fixed in
3.20.0
Source published
Source revised
Listed by VulniPulse

Compiled by VulniPulse from the linked sources. How records are collected and checked.

Affected products & platforms

Apache Software FoundationInfra & Gateways

Description

Authentication bypass by spoofing vulnerability in Apache APISIX.

On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.

This issue affects Apache APISIX: from 3.8.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Text from the source record.

Affected versions
  • 3.8.0 through 3.19.0.
  • through 3.19.0

Official advisory · high-confidence parse· fetched ·verify at source

How to fix CVE-2026-124666

Upgrade to a fixed release named by Apache:

  • 3.20.0

Vendor guidance

  • Users are recommended to upgrade to version 3.20.0, which fixes the issue.

More Apache Software Foundation advisories

Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories

Get an email when Apache Infra (APISIX/Traffic Server/CloudStack) publishes the next one.

See Apache Infra (APISIX/Traffic Server/CloudStack)'s last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.

Alert me about Apache Infra (APISIX/Traffic Server/CloudStack)