Ziyue

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator. This issue affects Apache APISIX: from 3.8.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

The `batch-requests` plugin contains a flaw where resources are allocated without limits or throttling. An unauthenticated caller can cause a gateway worker to experience Out of Memory (OOM)—a state where the system exhausts its available RAM—by targeting a route that utilizes the `batch-requests` plugin and has the `batch` endpoint publicly exposed.

An issue exists where the use of non-canonical URL paths for authorization decisions allows a crafted encoded path to reach an upstream endpoint. In configurations where a permissive route overlaps a protected one, requests that should be rejected are served instead, granting unauthenticated access to a protected upstream endpoint.

The backend `/services/request-service` RPC accepts a URL controlled by an attacker from any client connected to the standard `/services` messaging endpoint. The server performs the HTTP request and returns the full response body to the caller. Since the destination URL is not validated or allowlisted, a remote attacker with access to the service connection can execute server-side HTTP requests to localhost or other reachable backend hosts. This can expose internal administrative endpoints, cloud instance metadata services, and other resources located outside the browser network boundary. This issue primarily affects multi-tenant or publicly-reachable deployments.