CVE-2026-94269 Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch
Attackers can bypass authorization checks via crafted URL paths to access protected upstream endpoints in Apache APISIX.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94269?
CVE-2026-94269 is a medium-severity authentication bypass vulnerability in Apache APISIX, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.
In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Weakness: CWE-647
Which versions are affected by CVE-2026-94269?
1 open source package ship an affected version, including apisix.
| Package | Affected | Fixed in |
|---|---|---|
apisix Bitnami | From 2.14.1 | 3.19.0 |
How do I fix CVE-2026-94269?
Upgrade apisix to 3.19.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-94269 being exploited?
There is no known exploitation of CVE-2026-94269 in the wild and no public exploit code.
Sources
Also known as BIT-apisix-2026-94269, GHSA-37wm-6fqc-r75p, MINI-55v2-p3f6-vxg4.