Apache APISIX EUVD-2026-66956

Exploitation requires that the ldap-auth plugin is actively configured on at least one APISIX route or consumer - the vulnerability does not affect deployments that do not use this plugin. The attacker must possess valid credentials for at least one entry in the LDAP directory that the plugin is bound to (PR:L - low privilege, not unauthenticated). The target identity (the consumer being impersonated) must be mapped in the same LDAP directory instance that APISIX queries. Exploitation is limited to network-reachable APISIX deployments; local-only or air-gapped gateways reduce exposure. There is no requirement for user interaction, and no evidence that a non-default LDAP schema or special server configuration is required beyond the plugin itself being enabled.

The risk profile is driven primarily by the scope of the identity escalation: the attacker already holds valid LDAP credentials but can elevate to any APISIX consumer mapped in the directory, effectively bypassing the subtree-based access boundary the plugin enforces. No CVSS vector has been published by Apache or NVD at time of analysis, so severity must be inferred. The attack is network-reachable, requires no user interaction, and demands only low privilege (a valid LDAP credential), but attack complexity is low once the injection pattern is known, making this exploitable without sophisticated tooling. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation yet. However, LDAP injection in authentication middleware is a well-understood class with abundant public technique documentation, reducing the barrier to exploitation significantly. The real-world impact depends on how tightly APISIX consumer policies are scoped: in deployments where different consumers represent different tenants or privilege tiers, exploitation could mean cross-tenant data access or privilege escalation to higher-privileged API routes. No public exploit code has been identified at time of analysis, but the low technical bar means this could change quickly after disclosure.

An attacker provisioned with a low-privilege LDAP account (e.g., a service account in a restricted OU) sends a crafted authentication request to an APISIX route protected by ldap-auth, embedding LDAP metacharacters in the credential fields. The ldap-auth plugin constructs a malformed LDAP search filter that matches a different directory entry - one mapped to a high-privilege APISIX consumer with access to internal or administrative API routes - and returns a successful authentication for that impersonated identity. No public exploit code has been confirmed at time of analysis, but the LDAP injection technique is well-documented in public security literature.