Skip to content
VulniPulse
Sign inStart free
High7.0Apache Software Foundation Updated

CVE-2026-124680: Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX

This Apache advisory covers CVE-2026-124680 in Apache APISIX.

Open the Apache advisory

Key facts

Vendor rating
High, CVSS 7
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N · base score 7, scored by apacheAttack vector: network. Attack complexity: low. Attack requirements: present. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: high. Integrity impact on subsequent systems: high. Availability impact on subsequent systems: none.
Weakness
  • CWE-436 Interpretation Conflict, resulting in CWE-863 (Incorrect Authorization)
CISA SSVC
Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, .
CISA KEV
Not listed (catalogue checked )
Affected
0.9 through 3.19.0.; through 3.19.0
Fixed in
3.20.0
Source published
Source revised
Listed by VulniPulse

Compiled by VulniPulse from the linked sources. How records are collected and checked.

Affected products & platforms

Apache Software FoundationInfra & Gateways

Description

Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.

An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the

same upstream and the upstream does not collapse encoded dot segments.

This issue affects Apache APISIX: from 0.9 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Text from the source record.

Affected versions
  • 0.9 through 3.19.0.
  • through 3.19.0

Official advisory · high-confidence parse· fetched ·verify at source

How to fix CVE-2026-124680

Upgrade to a fixed release named by Apache:

  • 3.20.0

Vendor guidance

  • Users are recommended to upgrade to version 3.20.0, which fixes the issue.

More Apache Software Foundation advisories

Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories

Get an email when Apache Infra (APISIX/Traffic Server/CloudStack) publishes the next one.

See Apache Infra (APISIX/Traffic Server/CloudStack)'s last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.

Alert me about Apache Infra (APISIX/Traffic Server/CloudStack)