CVE-2026-124723

MediumCVSS 6.3/10Last modified Nov 13, 2026

Description

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.

With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Metrics

CVSS 4.0 6.3/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-436CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1247266.9Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenCVE-2026-124738.2Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A gCVE-2026-1247377.5A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standarCVE-2026-1247385.3A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only CVE-2026-1247397.5A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can triggeCVE-2026-1247404.3A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by respoCVE-2026-1247417.6A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copyinCVE-2026-1247425.5A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formCVE-2026-1247435.5A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header valuCVE-2026-1247446.3A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are CVE-2026-1247456.3A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic linksCVE-2026-1247465.5A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesyst
CVE-2026-124723: Medium severity, CVSS 6.3 | Vulnix