Apache APISIX 2.3.0<3.7.0 AuthZ-Keycloak Session Data Leak
CVE-2026-82806 Published on October 1, 2026
Apache APISIX: cross-request permission pollution via static permission list mutation
Exposure of data element to wrong session vulnerability in Apache APISIX.
This issue affects Apache APISIX: from 2.3.0 before 3.7.0.
Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions.
Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.
Vulnerability Analysis
CVE-2026-82806 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
Products Associated with CVE-2026-82806
Want to know whenever a new CVE is published for Apache Apisix? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache APISIX:- Version 2.3.0 and below 3.7.0 is affected.