Skip to main content

Apache APISIX CVE-2026-75020

| EUVDEUVD-2026-66956 HIGH
LDAP Injection (CWE-90)
2026-08-26 GHSA-fm68-53hc-8wxg
Apache Code Injection LDAP
7.0
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Network-reachable via LDAP auth endpoint; low-privilege credential required; scope changes as attacker assumes a different consumer identity with distinct permissions; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Aug 27, 2026 - 10:22 NVD
7.0 (HIGH)
Analysis Generated
Aug 26, 2026 - 16:21 vuln.today
CVE Published
Aug 26, 2026 - 15:29 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 3

News 3 New Apache Vulnerabilities - 3 High Severity Aug 27, 2026 News 3 New Redis Vulnerabilities - 1 Critical, 2 High Severity Aug 26, 2026 News Critical LDAP Injection in Grafana - CVE-2026-75020 Aug 26, 2026

AnalysisAI

LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege LDAP credentials
Delivery
Identify APISIX route using ldap-auth plugin
Exploit
Craft LDAP injection payload in auth request
Execution
Plugin resolves injected query to target consumer entry
Persist
Authenticate as high-privilege APISIX consumer
Impact
Access restricted upstream APIs or data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the ldap-auth plugin is actively configured on at least one APISIX route or consumer - the vulnerability does not affect deployments that do not use this plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The risk profile is driven primarily by the scope of the identity escalation: the attacker already holds valid LDAP credentials but can elevate to any APISIX consumer mapped in the directory, effectively bypassing the subtree-based access boundary the plugin enforces. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker provisioned with a low-privilege LDAP account (e.g., a service account in a restricted OU) sends a crafted authentication request to an APISIX route protected by ldap-auth, embedding LDAP metacharacters in the credential fields. The ldap-auth plugin constructs a malformed LDAP search filter that matches a different directory entry - one mapped to a high-privilege APISIX consumer with access to internal or administrative API routes - and returns a successful authentication for that impersonated identity. …
Remediation The primary remediation is to upgrade Apache APISIX to version 3.18.0, which contains the fix per the Apache project's own recommendation in the advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all APISIX deployments and identify instances running ldap-auth plugin in versions 2.11.0 through 3.17.0; document their network exposure and protected backend systems. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
CVE-2021-43350 CRITICAL
9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
CVE-2026-21880 MEDIUM POC
5.3 Jan 08

Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP au

Same weakness CWE-90 – LDAP Injection

View all
CVE-2016-9299 CRITICAL POC
9.8
CVE-2017-14596 CRITICAL POC
9.8
CVE-2017-8790 CRITICAL POC
9.8
CVE-2023-28853 MEDIUM POC
6.5
CVE-2026-44930 CRITICAL
9.8
CVE-2024-33868 CRITICAL
9.8
CVE-2023-6905 CRITICAL
9.8
CVE-2021-43350 CRITICAL
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-75020 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy