CVE-2026-94269

EUVD-2026-90768

01.10.2026, 12:17

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.

In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0.

Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	6.3 MEDIUM	NETWORK	LOW	NONE	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	apisix	2.14.1 ≤ 𝑥 ≤ 3.18.0	CNA

Common Weakness Enumeration

CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions
The software defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

References

https://lists.apache.org/thread.html/6p7glm8jtkjrn12t7z2ybn6bplm22tns

http://www.openwall.com/lists/oss-security/2026/10/01/7