CVE-2026-94269 in APISIX
Summary
by MITRE • 10/01/2026
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.
In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Apache APISIX represents a critical flaw in how the API gateway processes and validates URL paths during authorization decisions. This specific weakness stems from the use of non-canonical URL path representations when determining access control policies. In web security architecture, canonicalization refers to the process of normalizing input data into a standard format before processing it for logic or storage. When an application fails to properly normalize URLs, attackers can exploit discrepancies between how different layers of the network stack interpret encoded characters versus how the application's routing engine interprets them. This discrepancy allows malicious actors to bypass intended security controls by presenting paths that appear valid and authorized at one layer but are interpreted differently by another, effectively creating a blind spot in the authorization logic.
The technical mechanism behind this vulnerability involves the interaction between route matching algorithms and URL encoding schemes. Apache APISIX relies on specific routing rules defined by administrators to map incoming requests to upstream services while applying associated policies such as authentication or rate limiting. However, when a permissive route overlaps with a protected one in the configuration, the gateway's path resolution logic becomes susceptible to ambiguity. By crafting encoded paths that utilize alternative representations of standard characters—such as double encoding, mixed case variations, or unusual delimiter substitutions—an attacker can manipulate the routing engine into matching against the wrong rule set. Specifically, the crafted request may match a route with no authentication requirements rather than the intended protected route, thereby circumventing the security policies designed to restrict access to sensitive upstream endpoints.
The operational impact of this flaw is severe, as it directly compromises the confidentiality and integrity of protected resources. An attacker who successfully exploits this vulnerability can gain unauthenticated access to API endpoints that were explicitly configured to require authentication or specific authorization tokens. This means that sensitive data, administrative functions, or internal service communications exposed through these upstream endpoints become accessible to unauthorized users. In environments where Apache APISIX serves as the primary entry point for microservices, such a bypass could lead to full system compromise, data exfiltration, or further lateral movement within the network infrastructure. The issue affects versions from 2.14.1 through 3.18.0, indicating that this is a persistent architectural weakness in how path normalization was handled across multiple major releases of the software.
From an industry standards perspective, this vulnerability aligns with CWE-697, which describes Incorrect Comparison, and more specifically CWE-20, Improper Input Validation, regarding the failure to normalize input before processing it for security decisions. It also relates to ATT&CK technique T1583.004, Domain Fronting or similar evasion techniques where attackers use encoding tricks to bypass detection mechanisms. The core issue is a classic case of path traversal logic error where the assumption that all equivalent URL representations are treated identically by both the client and server proves false in practice due to inconsistent canonicalization practices within the gateway's routing engine.
To mitigate this risk, organizations running affected versions must upgrade Apache APISIX to version 3.19.0 or later immediately. This release includes patches that enforce strict canonicalization of URL paths before they are evaluated against route policies, ensuring that encoded variations do not lead to incorrect rule matching. In addition to upgrading, administrators should review their routing configurations to ensure there is no ambiguity between permissive and protected routes. Implementing defense-in-depth strategies such as WAF rules that detect abnormal encoding patterns or enforcing strict input validation at the application layer can provide additional layers of protection against similar canonicalization-based attacks in other components of the infrastructure.