CVE-2026-94220

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0

Description Cross-Site Request Forgery (CSRF) exists in the feishu-auth and dingtalk-auth plugins. An attacker can trick a user into clicking a crafted link, causing the user's browser session on a protected route to be established under the attacker's identity. Consequently, any actions performed by the user during that session, such as form submissions, uploads, or account bindings, will be associated with the attacker's account.

Recommendations Upgrade to version 3.19.0.