Vulnerability · high · CVSS 7
Apache APISIX route-level authentication bypass via path normalization
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Apache APISIX deployments from 0.9 through 3.19.0 using route-level authentication
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
The Brief
- CVE-2026-124680 is a route-level authentication bypass in Apache APISIX caused by a path normalization mismatch between routing and upstream forwarding.
- The flaw is an interpretation conflict that results in an incorrect authorization vulnerability.
- Affected versions are Apache APISIX 0.9 through 3.19.0, with a CVSS 4.0 base score of 7.0 (high).
Why it matters
Authentication rules configured on APISIX routes can be bypassed by requests whose paths are normalized differently by the router and the upstream, so protected upstream services may be reachable without credentials.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: APISIX is an API gateway that developers and ops teams run in their infrastructure. |
| No | Core infrastructure | Judgment: a single API gateway product, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Apache APISIX is a widely deployed API gateway used by many teams. |
| No | Exploited in the wild | Open Source Security post describes a vulnerability only; it reports no observed attacks. |
| No | Public exploit | Open Source Security post gives a description and CVSS score; it mentions no published exploit or PoC. |
| Yes | Remote, no login | CVSSCVE-2026-124680: CVSS 7 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | Open Source Security describes a routing bypass; it reports no stolen credentials, keys or data. |
| No | Supply chain | Open Source Security describes a path normalization flaw in APISIX; no malicious code shipped through a trusted channel is reported. |
| No | No fix yet | Open Source Security lists affected versions 0.9 through 3.19.0 but does not say whether a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-124680 ↗CVSS 7 high AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-436
Timeline
Vulnerability disclosed on Open Source Security
Open Source Security
CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding
Source
CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided