Apache APISIX CVE-2025-62232

Exploitation requires the APISIX log level to be configured to INFO or DEBUG (not the default WARN) AND the basic-auth plugin to be in use; under these conditions plaintext credentials are written to error logs and forwarded to any configured log sinks. The attacker must then have read access to those error logs or downstream log aggregation systems to harvest the credentials - the flaw does not itself grant log access. Limiting factors: default (non-verbose) logging configurations are not affected, and successful credential theft depends on pre-existing access to the log storage or sink, meaning this is primarily an insider / post-compromise / supply-chain-of-logs risk rather than direct remote exploitation against default configurations.

This is a CWE-532 credential-in-logs disclosure in the Apache APISIX basic-auth plugin, scored CVSS 7.5 (C:H/I:N/A:N) with no public exploit identified at time of analysis (no POC, not in CISA KEV, no EPSS score supplied). The headline signal to scrutinize is the CVSS vector: AV:N/AC:L/PR:N/UI:N portrays a trivially remote, unauthenticated, default-configuration flaw, but the description contradicts this - exploitation is contingent on (1) the log level being set to INFO or DEBUG, which is NOT the default (APISIX defaults to WARN), and (2) an actor already having read access to the error logs or downstream log sinks (SIEM, log aggregator, file system). Those are the real preconditions, so the practical attack surface is far narrower than AV:N/PR:N suggests - this is better characterized as a local/configuration-dependent information exposure than a remotely exploitable one. The impact is nonetheless serious where conditions are met: plaintext usernames and passwords flowing into log pipelines widely multiplies who can harvest them and enables lateral movement. Net assessment: a genuine credential-hygiene priority for operators running verbose logging, but NOT a drive-by network-exploitable critical issue; the CVSS 7.5 overstates real-world remote risk for default deployments. Conflict to verify: CVSS claims network vector with no privileges, yet the described attack requires non-default verbose logging plus log-access - verify intended attack model with Apache.

An operator runs APISIX with log level set to INFO or DEBUG; every basic-auth request causes the plugin to write the plaintext username and password into the error log, which is forwarded to a centralized log sink. An insider, a compromised logging/monitoring account, or anyone with read access to the aggregated logs then harvests these credentials and replays them against protected upstream APIs. No public exploit code is required - the credentials are simply present in readable logs.