CVE-2026-94269: Apache APISIX Auth Bypass Vulnerability

CVE-2026-94269 Overview

CVE-2026-94269 is an authorization bypass vulnerability in Apache APISIX caused by the use of non-canonical URL paths for authorization decisions [CWE-647]. When a permissive route overlaps a protected route, an attacker can craft an encoded path that reaches an upstream endpoint outside the matched route's intended policy scope. Requests that the gateway should have rejected are instead served, exposing protected upstream endpoints to unauthenticated callers.

The flaw affects Apache APISIX versions from 2.14.1 through 3.18.0. The Apache APISIX project has released version 3.19.0 to address the issue.

Critical Impact
Unauthenticated attackers can reach protected upstream endpoints by sending crafted URL-encoded paths that bypass route-level authorization policies.

Affected Products

Apache APISIX 2.14.1 through 3.18.0
Deployments where a permissive route overlaps a protected route in the same gateway
API gateway configurations relying on path-based plugin enforcement (for example, jwt-auth, key-auth, basic-auth, consumer-restriction)

Discovery Timeline

2026-10-01 - CVE CVE-2026-94269 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-94269

Vulnerability Analysis

Apache APISIX is an open-source, dynamic API gateway that routes client requests to upstream services and applies plugins such as authentication, rate limiting, and traffic control at the route level. The vulnerability stems from how the gateway compares the request path against configured routes when deciding which policies to apply.

APISIX matches routes using the request path as received, without first reducing encoded or alternative representations to a single canonical form. When two routes overlap (one permissive and one protected), an attacker can shape a path that matches the permissive route for policy purposes while the upstream proxy still forwards the request to the protected endpoint.

The result is a split view between the authorization decision and the request that actually reaches the backend. Operators who assume plugin configuration on the protected route gates all traffic to that upstream do not get that guarantee.

Root Cause

The root cause is classified under CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions. APISIX applies authorization using a path representation that differs from the one used during upstream dispatch. Percent-encoded characters, mixed-case segments, or redundant separators can create matching ambiguity between the two stages.

Attack Vector

The attack is remote and unauthenticated. An attacker inspects the gateway's public routing surface, identifies a permissive route whose path pattern overlaps a protected one, and sends an HTTP request whose encoded path matches the permissive rule. APISIX evaluates plugins against the permissive route and proxies the request upstream, where the protected endpoint handles it. No credentials, user interaction, or prior foothold are required.

Technical details are available in the Apache Mailing List Thread and the Openwall OSS Security Update.

Detection Methods for CVE-2026-94269

Indicators of Compromise

Access log entries containing percent-encoded characters such as %2F, %2E, or mixed-case escapes within the request path targeting sensitive upstream endpoints.
Successful 2xx responses from APISIX for upstream paths that normally require an Authorization header but show no authentication headers in the log.
Mismatches between the matched route_id recorded by APISIX and the upstream endpoint actually invoked.

Detection Strategies

Enable APISIX access logging with the route_id, decoded request_uri, and upstream URI fields, then alert when a permissive route serves traffic to a protected upstream host or path prefix.
Compare raw request paths against their canonicalized form at an upstream reverse proxy or WAF, and flag divergence.
Hunt historical gateway logs for requests to protected endpoints that lack the authentication token fields the protected route normally records.

Monitoring Recommendations

Forward APISIX access and error logs to a centralized analytics platform and build dashboards grouping traffic by matched route and upstream.
Add alerts for sudden drops in authentication-plugin denials paired with sustained traffic to the same upstream path.
Track the Apache APISIX version string reported by gateway nodes to confirm patched builds remain deployed.

How to Mitigate CVE-2026-94269

Immediate Actions Required

Upgrade Apache APISIX to version 3.19.0 or later on all gateway nodes.
Audit route configurations for overlapping path patterns, especially cases where a broad permissive route sits above a stricter protected route.
Verify that every upstream endpoint requiring authentication has its auth plugins attached to the specific protected route rather than relying on a parent prefix.

Patch Information

Apache APISIX 3.19.0 fixes the authorization bypass by aligning the path representation used for route matching with the one used during upstream dispatch. Users on any release from 2.14.1 through 3.18.0 are directed to upgrade. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

Restructure routes to eliminate overlap between permissive and protected paths until the upgrade is complete.
Place a front-facing proxy or WAF that normalizes URL paths (decodes percent-encoding and collapses redundant separators) before traffic reaches APISIX.
Apply authentication plugins at the consumer or global level where feasible, so protection does not depend on a single route match.

bash

# Configuration example
# Verify installed APISIX version on each gateway node
apisix version

# Example upgrade path using the official Docker image
docker pull apache/apisix:3.19.0-debian
docker stop apisix && docker rm apisix
docker run -d --name apisix \
  -p 9080:9080 -p 9443:9443 -p 9180:9180 \
  -v $(pwd)/apisix_conf/config.yaml:/usr/local/apisix/conf/config.yaml \
  apache/apisix:3.19.0-debian