Apache APISIX <3.20 Auth Bypass via Wolf-RBAC Header Spoofing
CVE-2026-124666 Published on November 13, 2026
Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
Authentication bypass by spoofing vulnerability in Apache APISIX.
On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.
This issue affects Apache APISIX: from 3.8.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Vulnerability Analysis
CVE-2026-124666 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-124666
Want to know whenever a new CVE is published for Apache Apisix? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache APISIX:- Version 3.8.0, <= 3.19.0 is affected.