CVE-2026-124666
Authentication bypass by spoofing vulnerability in Apache APISIX.
On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore
Authentication bypass by spoofing vulnerability in Apache APISIX.
On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.
This issue affects Apache APISIX: from 3.8.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.