Apache APISIX CVE-2026-63041

Exploitation requires that the attach-consumer-label plugin is explicitly enabled on one or more APISIX routes - this plugin is not active by default and must be deliberately added to a route's plugin chain. The affected route must use consumer labels as part of its authorization logic; routes that configure the plugin but do not enforce access control based on label values are not exploitable for privilege escalation. The attacker must have network access to the APISIX data-plane port on which the affected route is exposed. Authentication requirements are not confirmed by CVSS data (none was provided), but the privilege escalation framing in the advisory implies the attacker reaches the plugin after passing at least low-privilege consumer authentication - in routes where authentication is enforced prior to the plugin. In routes where no authentication plugin precedes attach-consumer-label, unauthenticated header injection may be possible. Exploitation is version-bounded to 3.11.0-3.17.0; earlier versions are not listed as affected.

No CVSS vector or score was provided in the source data; all metric assessments here are independently inferred from the advisory text. The attack vector is network-based with low complexity - exploitation requires only a crafted HTTP request with a forged header, with no user interaction. Privilege requirements are assessed as low (PR:L), since the attach-consumer-label plugin typically operates downstream of an authentication plugin in the APISIX pipeline, implying the attacker holds at least a low-privilege consumer credential; however, in misconfigured routes where no authentication plugin precedes it, unauthenticated exploitation cannot be ruled out. EPSS data was not provided. This CVE is not listed in CISA KEV, and no public exploit code has been identified - yet the vulnerability class (header injection enabling auth bypass) is historically high-value and low-skill to reproduce once the header name and expected label values are known. The 'fix version pending' status is the primary risk amplifier: all deployments on 3.11.0-3.17.0 remain unpatched with no vendor release date confirmed.

An attacker with low-privilege consumer credentials on an Apache APISIX 3.11.0-3.17.0 instance sends an HTTP request to a route protected by consumer-label-based authorization, manually injecting a forged consumer-label header value matching a higher-privileged label (such as one gating an admin-only route or a premium service tier). Because the attach-consumer-label plugin does not strip the client-supplied header, the gateway evaluates the forged label and grants access to resources the attacker's actual consumer identity is not authorized to reach. No public exploit code has been identified at time of analysis, but the technique requires only knowledge of the expected header name and a valid label value - both potentially discoverable through API enumeration or documentation.