EUVD-2026-66409
GHSA-h244-w3g4-3cv4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable after low-privilege consumer auth (PR:L); forged labels cross authorization boundaries affecting multiple routes (S:C); no availability impact described in advisory.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Authorization bypass and privilege escalation in Apache APISIX 3.11.0-3.17.0 stem from the attach-consumer-label plugin failing to strip client-supplied consumer-label headers before using them in security decisions. An attacker who can reach the gateway can forge header values to impersonate a higher-privileged consumer label, bypassing route-level access controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the `attach-consumer-label` plugin is explicitly enabled on one or more APISIX routes - this plugin is not active by default and must be deliberately added to a route's plugin chain. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or score was provided in the source data; all metric assessments here are independently inferred from the advisory text. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the advisory lists the fix version as pending. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all APISIX deployments to identify any running versions 3.11.0-3.17.0 and assess which external networks can reach the gateway. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Rated medium sev
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. Rated high severity (CVSS 7.
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as
CPU exhaustion via algorithmic complexity in Apache APISIX 3.17.0 allows unauthenticated remote attackers to pin a gatew
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listeni
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the er
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entr
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverles
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forwa
CVE-2025-46647 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management proce
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today