CVE-2026-94269
Deferred Deferred - Pending Action

Authorization Bypass via Non-Canonical Path in Apache APISIX

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-94269
EUVD
EUVD-2026-90768

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apisix From 2.14.1 (inc) to 3.18.0 (inc)
apache apisix 3.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-647 The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache APISIX involves the use of non-canonical URL paths for authorization decisions. When a permissive route overlaps a protected one, a crafted encoded path can bypass intended access controls, allowing unauthenticated requests to reach protected upstream endpoints that should have been rejected.

Detection Guidance

To detect this vulnerability, check Apache APISIX versions between 2.14.1 and 3.18.0. Run: apisix version to verify the installed version. Inspect route configurations for overlapping permissive and protected routes. Monitor logs for unauthorized access attempts to protected endpoints.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive endpoints or data, potentially leading to data breaches, unauthorized actions, or other security incidents depending on the protected resources involved.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, which may violate compliance requirements such as GDPR or HIPAA. Organizations using affected versions of Apache APISIX may face regulatory penalties or legal consequences if exploited.

Mitigation Strategies

Upgrade Apache APISIX to version 3.19.0 or later immediately. Review and adjust route configurations to prevent overlapping permissive and protected routes. Apply strict access controls and monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart