Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 6.4 (medium) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N Affected versions: - Apache APISIX 3.8.0 through 3.19.0 Description: Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those...
CVE-2026-124666: Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/691
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-124723: Apache APISIX: unauthorized access to mTLS protected resources
Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 6.3 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Affected versions: - Apache…
CVE-2026-124716: Apache APISIX: authz-keycloak authorization scope mismatch
Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 6.4 (medium) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N Affected versions: - Apache…
CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding
Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 7.0 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N Affected versions: - Apache APISIX…
CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 7.8 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N Affected versions: - Apache APISIX…
CVE-2026-123338: Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch
Posted by Lee Rhodes on Nov 12 Severity: moderate Affected versions: - Apache DataSketches C++ 3.0.0 through 5.3.0 Description: Out-of-bounds Write vulnerability in…
CVE-2026-123274: Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch
Posted by Lee Rhodes on Nov 12 Severity: moderate Affected versions: - Apache DataSketches C++ 2.0.0-incubating through 5.3.0 Description: Out-of-bounds Write…