CVE-2020-13945 Hardcoded credentials in Apache APISIX
Attackers can access APISIX management data using the default token if IP restrictions are removed, requiring configuration changes to secure the Admin API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13945?
CVE-2020-13945 is a medium-severity vulnerability in Apache APISIX, published on 7 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
Which versions are affected by CVE-2020-13945?
1 open source package ship an affected version, including apisix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apisix Bitnami | From 1.2.0 | 1.5.1 |
Products include Apache Apisix.
How do I fix CVE-2020-13945?
Upgrade apisix to 1.5.1 or later.
Is CVE-2020-13945 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-13945 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Apache APISIX
- CVE-2022-24112 Apache APISIX Authentication Bypass
- CVE-2022-25757 Apache APISIX: the body_schema check in request-validation plugin can be bypassed
- CVE-2026-31908 Apache APISIX: forward auth plugin allows header injection
- CVE-2026-75005 Apache APISIX: Unauthenticated CPU-exhaustion DoS
- CVE-2025-27446 Privilege escalation in Apache APISIX Java Plugin Runner
Sources
Also known as BIT-apisix-2020-13945, GHSA-c538-784j-qcxc.