Skip to content
VulniPulse
Sign inStart free
Medium6.3Apache Software Foundation Updated

CVE-2026-124723: Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX

This Apache advisory covers CVE-2026-124723 in Apache APISIX.

Open the Apache advisory

Key facts

Vendor rating
Medium, CVSS 6.3
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N · base score 6.3, scored by apacheAttack vector: network. Attack complexity: low. Attack requirements: present. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: low. Integrity impact on subsequent systems: low. Availability impact on subsequent systems: none.
Weakness
  • CWE-436 Interpretation Conflict
  • CWE-863 Incorrect Authorization
CISA SSVC
Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, .
CISA KEV
Not listed (catalogue checked )
Affected
3.18.0 through 3.19.0.; through 3.19.0
Fixed in
3.20.0
Source published
Source revised
Listed by VulniPulse

Compiled by VulniPulse from the linked sources. How records are collected and checked.

Affected products & platforms

Apache Software FoundationInfra & Gateways

Description

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.

With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream

behind a route that requires one, limited to request paths that decode to an exempted URI.

This issue affects Apache APISIX: from 3.18.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Text from the source record.

Affected versions
  • 3.18.0 through 3.19.0.
  • through 3.19.0

Official advisory · high-confidence parse· fetched ·verify at source

How to fix CVE-2026-124723

Upgrade to a fixed release named by Apache:

  • 3.20.0

Vendor guidance

  • Users are recommended to upgrade to version 3.20.0, which fixes the issue.

More Apache Software Foundation advisories

Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories

Get an email when Apache Infra (APISIX/Traffic Server/CloudStack) publishes the next one.

See Apache Infra (APISIX/Traffic Server/CloudStack)'s last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.

Alert me about Apache Infra (APISIX/Traffic Server/CloudStack)