UpHeron
All vulnerabilities

Servers and applications

CVE-2026-124666

Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

Severity
Medium 6.4
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Weakness
Authentication bypass by spoofing (CWE-290)
Attack
Over the network · Needs a user account · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Sources
CVE Program

Description

Authentication bypass by spoofing vulnerability in Apache APISIX.

On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.

This issue affects Apache APISIX: from 3.8.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

From the CVE Program.

Affected software

SoftwareAffected versions
Apache APISIXServers and applications · cna:apache software foundation|apache apisix
  • From 3.8.0 up to 3.19.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124666