CVE-2025-27446: Apache APISIX Privilege Escalation Flaw

CVE-2025-27446 Overview

CVE-2025-27446 is an Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in the Apache APISIX java-plugin-runner. The flaw involves permissions on a local listening file used by the plugin runner. A local attacker with low-privileged access to the host can abuse these permissions to elevate privileges to the account running APISIX. The issue affects Apache APISIX java-plugin-runner versions 0.2.0 through 0.5.0. Apache resolved the flaw in version 0.6.0.

Critical Impact
Local privilege escalation to the APISIX plugin runner process context, leading to full compromise of gateway configuration, plugins, and proxied traffic.

Affected Products

Apache APISIX java-plugin-runner0.2.0
Apache APISIX java-plugin-runner versions between 0.2.0 and 0.5.0
Apache APISIX java-plugin-runner0.5.0

Discovery Timeline

2025-07-06 - CVE-2025-27446 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27446

Vulnerability Analysis

Apache APISIX supports external plugin runners that execute custom logic in languages such as Java. The java-plugin-runner communicates with the APISIX core through a local inter-process channel exposed as a listening file on the host filesystem, typically a Unix domain socket. This socket is the trust boundary between the gateway process and the plugin runner. Any local account that can read or write to this file can inject or intercept plugin runner messages.

In versions 0.2.0 through 0.5.0, the runner creates this listening file with overly permissive access controls. Local users on the same host who would not normally have access to the gateway internals can interact with the socket. This exposure allows attackers to send crafted plugin control messages and execute logic in the context of the higher-privileged runner process.

Root Cause

The root cause is Incorrect Permission Assignment for Critical Resource [CWE-732]. The java-plugin-runner did not restrict file mode bits or ownership on the local listening file when it was created. As a result, the socket was accessible to users other than the intended APISIX service account, breaking the isolation model between the gateway and unprivileged local users.

Attack Vector

Exploitation requires local access to the host running APISIX with the vulnerable java-plugin-runner. An attacker with a low-privileged shell locates the plugin runner socket, connects to it, and issues protocol messages that the runner processes with its own privileges. Because the runner participates in request handling, attackers can influence plugin execution, exfiltrate secrets held by plugins, or achieve code execution in the runner context. Full technical details are documented in the Apache Mailing List Thread and the OpenWall OSS Security Discussion.

Detection Methods for CVE-2025-27446

Indicators of Compromise

Unix domain socket files belonging to the APISIX plugin runner with world-readable or world-writable permissions such as 0666 or 0777.
Unexpected local processes connecting to the java-plugin-runner socket path outside of the APISIX service account.
Plugin runner log entries showing requests from unknown or unauthenticated local clients.

Detection Strategies

Audit filesystem permissions on the plugin runner listening file with ls -l and stat and alert on any mode broader than 0600 or 0660 restricted to the service group.
Monitor process ancestry for shells or scripts under non-APISIX users opening file descriptors to the runner socket using lsof or ss -xp.
Correlate APISIX gateway logs with plugin runner logs to identify plugin invocations that lack a matching upstream HTTP request.

Monitoring Recommendations

Enable Linux audit rules on the plugin runner socket path to log all connect() and open() events from non-service UIDs.
Track APISIX java-plugin-runner version in configuration management and alert on any host still running 0.2.0 through 0.5.0.
Review scheduled tasks and startup scripts on APISIX hosts for changes that would broaden permissions on the runner socket.

How to Mitigate CVE-2025-27446

Immediate Actions Required

Upgrade Apache APISIX java-plugin-runner to version 0.6.0 or later on all gateway hosts.
Restrict shell and SSH access on APISIX hosts to reduce the pool of accounts that could exploit the local socket.
Rotate any credentials, API keys, or JWT signing keys handled by custom Java plugins on affected hosts.

Patch Information

Apache fixed the issue in java-plugin-runner version 0.6.0. Operators should upgrade the runner artifact deployed alongside APISIX and restart the gateway to load the patched binary. Refer to the Apache Mailing List Thread for the official disclosure and version guidance.

Workarounds

Set the runner listening file permissions to 0600 and ensure it is owned by the APISIX service account until the upgrade is applied.
Place the socket file in a directory whose parent has mode 0700 owned by the APISIX user, blocking traversal by other local accounts.
Isolate APISIX on a dedicated host or container without interactive local users to remove the local attack surface entirely.

bash

# Configuration example: restrict the plugin runner socket after startup
chown apisix:apisix /usr/local/apisix/plugin_runner.sock
chmod 0600 /usr/local/apisix/plugin_runner.sock
chmod 0700 /usr/local/apisix