What is the CVSS score of CVE-2026-31924?

CVE-2026-31924 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Apache CVE-2026-31924

EUVD-2026-22227 MEDIUM

Cleartext Transmission of Sensitive Information (CWE-319)

2026-04-14 apache

GHSA-ww73-h4g4-66vr

Information Disclosure Apache

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 22:35 vuln.today

CVSS changed

Apr 14, 2026 - 20:22 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 08:30 euvd

EUVD-2026-22227

Analysis Generated

Apr 14, 2026 - 08:30 vuln.today

CVE Published

Apr 14, 2026 - 08:08 nvd

MEDIUM 5.3

DescriptionCVE.org

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.

tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

AnalysisAI

Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent Cloud CLS, allowing network-based attackers to intercept and read confidential information without authentication. Vendor-released patch: version 3.16.0. EPSS indicates low real-world exploitation probability (0.01%), though the attack vector is unauthenticated and low-complexity, suggesting availability of automated interception tools rather than active targeted exploitation.

Technical ContextAI

The vulnerability resides in Apache APISIX's Tencent Cloud CLS (Cloud Log Service) export plugin, which handles transmission of log data containing potentially sensitive operational and security information. The underlying issue is the use of unencrypted HTTP instead of HTTPS for log transmission, violating CWE-319 (Cleartext Transmission of Sensitive Information). This affects the entire APISIX API gateway platform, which is widely used for API traffic management and observability; the CPE cpe:2.3:a:apache_software_foundation:apache_apisix indicates the vulnerability applies to all APISIX instances with the affected CLS export feature enabled across versions 2.99.0 through 3.15.0.

RemediationAI

Upgrade Apache APISIX to version 3.16.0 or later, which enforces HTTPS for Tencent Cloud CLS log export. Users unable to upgrade immediately should disable the CLS export plugin or restrict outbound log transmission to isolated network segments not accessible to untrusted parties. If CLS export must remain active in pre-3.16.0 deployments, configure a reverse proxy or VPN tunnel to encrypt the log transmission path. Consult the Apache APISIX advisory at https://lists.apache.org/thread/sqxjjlt87c1q28db28ztdxylm5pgwohq for version-specific upgrade guidance.