CVE-2026-94220
Deferred Deferred - Pending Action

CSRF in Apache APISIX feishu-auth and dingtalk-auth Plugins

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-94220
EUVD
EUVD-2026-90766

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apisix From 3.17.0 (inc) to 3.18.0 (inc)
apache apisix 3.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Apache APISIX's feishu-auth and dingtalk-auth plugins. It allows an attacker to trick a user into clicking a malicious link, causing the user's browser session to perform actions under the attacker's identity instead of the user's own.

Detection Guidance

This vulnerability is specific to Apache APISIX versions 3.17.0 through 3.18.0 and involves CSRF in feishu-auth and dingtalk-auth plugins. Detection requires checking the installed APISIX version and plugin configurations. No direct network commands detect this, but you can verify version and plugin status via APISIX admin API or logs.

Impact Analysis

If exploited, an attacker could perform actions on your behalf, such as uploading files, submitting forms, or binding accounts. This could lead to unauthorized access to your data or account.

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized account access or actions through crafted links. If an attacker gains control of a user's session, they could perform actions like data uploads or form submissions under the user's identity, which may violate data integrity and access control requirements in these regulations.

Mitigation Strategies

Upgrade Apache APISIX to version 3.19.0 or later to fix the CSRF vulnerability in feishu-auth and dingtalk-auth plugins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart