CVE-2026-124680

{
  "etk_id": "ETK-2026-4416",
  "cve_id": "CVE-2026-124680",
  "display_id": "CVE-2026-124680",
  "ghsa_id": "GHSA-wgxx-h925-9wh7",
  "euvd_id": "EUVD-2026-125678",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass through path interpretation in Apache APISIX",
  "summary": "Apache APISIX versions 0.9 through 3.19.0 can apply route authorization inconsistently when paths are interpreted differently by APISIX and an upstream service. An unauthenticated client may reach upstream paths intended to require route-level authentication when authenticated and unauthenticated routes share an upstream and that upstream preserves encoded dot segments.",
  "mitigation": "Upgrade Apache APISIX to version 3.20.0. Until upgraded, avoid sharing an upstream between authenticated and unauthenticated routes where the upstream accepts encoded dot segments.",
  "vendor": "Apache Software Foundation",
  "product": "Apache APISIX",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.9, <= 3.19.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache APISIX",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.545323266666667,
  "t0_at": "2026-11-13T17:51:28.431000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T17:51:28.431000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T17:51:28.431000+00:00",
      "url": "https://github.com/advisories/GHSA-wgxx-h925-9wh7"
    }
  }
}