UpHeron
All vulnerabilities

Servers and applications

CVE-2026-124723

Apache APISIX: unauthorized access to mTLS protected resources

Severity
Medium 6.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Weakness
CWE-436Incorrect authorization (CWE-863)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Sources
CVE Program

Description

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.

With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

From the CVE Program.

Affected software

SoftwareAffected versions
Apache APISIXServers and applications · cna:apache software foundation|apache apisix
  • From 3.18.0 up to 3.19.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124723