CVE-2026-75020: Apache APISIX LDAP Injection Vulnerability

CVE-2026-75020 Overview

CVE-2026-75020 is an LDAP injection vulnerability in Apache APISIX, an open-source API gateway. The flaw resides in the LDAP authentication plugin, which fails to properly neutralize special characters in Lightweight Directory Access Protocol (LDAP) queries [CWE-90]. An attacker holding valid credentials for one LDAP directory entry can authenticate through APISIX as a consumer mapped to a different entry. This bypasses the scope restrictions the plugin was configured to enforce. The vulnerability affects Apache APISIX versions 2.11.0 through 3.17.0. The Apache Software Foundation released version 3.18.0 to remediate the issue.

Critical Impact
Authenticated attackers can bypass LDAP authentication scope restrictions and impersonate consumers mapped to directory entries outside their intended access boundary.

Affected Products

Apache APISIX 2.11.0 through 3.17.0
Apache APISIX deployments using the LDAP authentication plugin
API gateway configurations relying on LDAP scope filters for consumer isolation

Discovery Timeline

2026-08-27 - CVE-2026-75020 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-75020

Vulnerability Analysis

Apache APISIX ships an LDAP authentication plugin that maps callers to consumer objects based on directory lookups. The plugin constructs LDAP search filters using caller-supplied input without adequate sanitization of LDAP metacharacters. Attackers can inject filter syntax such as wildcards, logical operators, and parentheses into the authentication request. The injected syntax alters the resulting filter and causes the directory server to return entries the plugin was configured to exclude.

A caller who possesses valid credentials for any single LDAP entry can leverage this behavior to authenticate as a consumer bound to a different entry. The plugin treats the mismatched result as a successful bind and issues the associated consumer identity to the upstream service. Downstream services then process the request under the impersonated consumer's permissions, defeating the tenant separation model that scope filters are intended to enforce.

Root Cause

The root cause is improper neutralization of special elements used in an LDAP query, tracked as [CWE-90]. The plugin concatenates untrusted input directly into LDAP search filters instead of escaping reserved characters such as *, (, ), \, and NUL. This allows the caller to modify filter semantics rather than only supplying filter values.

Attack Vector

Exploitation requires network access to an APISIX gateway that uses the LDAP authentication plugin. The attacker must hold valid credentials for at least one entry in the target directory. The attacker submits a crafted authentication request containing LDAP filter metacharacters in the identifier field. APISIX performs the modified search, matches an out-of-scope entry, and completes authentication as the associated consumer. Consult the Apache Mailing List Discussion for technical details published by the project.

Detection Methods for CVE-2026-75020

Indicators of Compromise

LDAP authentication requests containing metacharacters such as *, (, ), or \ in the username or identifier field submitted to APISIX routes.
APISIX access logs showing successful authentication events where the resolved consumer identity does not correspond to the caller's expected directory scope.
Directory server logs recording search filters that deviate from the templates the plugin normally emits.

Detection Strategies

Enable verbose logging on the APISIX LDAP plugin and forward events to a centralized analytics platform for correlation against expected consumer mappings.
Baseline the LDAP filters emitted by APISIX and alert on filters containing wildcard characters or unexpected boolean operators.
Correlate authentication events with upstream authorization decisions to identify consumers that suddenly access resources outside their historical patterns.

Monitoring Recommendations

Monitor APISIX and directory server logs for spikes in authentication attempts targeting the LDAP plugin.
Track version metadata across all APISIX instances to identify hosts still running 2.11.0 through 3.17.0.
Alert on any consumer authenticating from source networks inconsistent with prior activity for that identity.

How to Mitigate CVE-2026-75020

Immediate Actions Required

Upgrade all Apache APISIX deployments to version 3.18.0 or later, which contains the vendor fix.
Inventory every route that references the LDAP authentication plugin and confirm the runtime version reported by each data plane node.
Rotate credentials for any LDAP consumer whose logs indicate possible impersonation during the exposure window.

Patch Information

The Apache APISIX project fixed CVE-2026-75020 in version 3.18.0. The vendor recommends upgrading directly to this release. Full remediation details are published on the Apache Mailing List Discussion.

Workarounds

Disable the LDAP authentication plugin on affected routes until the upgrade to 3.18.0 is complete.
Substitute an alternative authentication plugin such as key-auth, jwt-auth, or openid-connect where feasible during the maintenance window.
Restrict network access to APISIX admin and data plane endpoints so that only trusted clients can submit authentication requests.

bash

# Verify installed Apache APISIX version and plan the upgrade to 3.18.0
apisix version

# Temporarily disable the ldap-auth plugin on an affected route via the Admin API
curl -X PATCH "http://127.0.0.1:9180/apisix/admin/routes/<route_id>/plugins/ldap-auth" \
  -H "X-API-KEY: <admin_key>" \
  -H "Content-Type: application/json" \
  -d 'null'