Apache says an unauthenticated client can reach a protected upstream path under a specific route and upstream configuration. Its advisory covers Apache APISIX 0.9 through 3.19.0 and names 3.20.0 as the fixed version.The first triage step is to identify APISIX versions and routes that share an upstream. Then compare authentication rules on those routes and verify how the upstream handles encoded dot segments. The vendor's stated conditions matter more than the CVSS score alone when deciding which deployments need immediate attention.
What it allows
How Does CVE-2026-124680 Bypass Route Authentication?
Apache describes a mismatch between route matching and the path forwarded to an upstream. A route without authentication must share that upstream with a route protected by a route-level authentication plugin. The upstream also must not collapse encoded dot segments. Under those conditions, an unauthenticated client can reach a path that the protected route was meant to guard.
This is a configuration-dependent bypass, not a claim that every APISIX route exposes protected content. Inspect route ownership, shared upstreams, and plugin placement before assigning exposure. For prioritization work, the vulnerability intelligence platform is the relevant Brandefense product page.
Brandefense Blackhole counted one dark-chat post mentioning CVE-2026-124680 from 16 August through 14 November 2026. This is one discussion record in that period, not proof of exploitation or an incident. The CISA KEV catalog explainer covers a separate evidence category. CISA's 13 November 2026 catalog snapshot did not list this CVE.
Who is affected
Which Apache APISIX Versions and Routes Are Affected?
Apache lists APISIX versions 0.9 through 3.19.0 as affected and recommends upgrading to 3.20.0. The advisory states a single version span, but real exposure also requires the route and upstream conditions described above. A version match alone does not show that authentication can be bypassed in a particular deployment.
Inventory each APISIX instance and record its running version. For instances in the stated range, identify upstreams shared by authenticated and unauthenticated routes. Check whether the upstream collapses encoded dot segments, and document the result without sending exploit requests. The vulnerability management process guide can help track that evidence through remediation.
Apache gives one broad span across major releases, rather than separate bounds for each release branch. Verify older installations and supported upgrade paths against Apache's release guidance before changing production traffic. After the upgrade, confirm the running APISIX version and repeat the route and upstream configuration review.
Timeline
- 2026-11-13
Apache disclosed CVE-2026-124680 and recommended Apache APISIX 3.20.0.
- 2026-11-13
NVD published the CVE record; the CISA KEV snapshot dated that day did not list it.
What to do
-
Inventory APISIX versions and route relationships
Record every running APISIX version, then identify upstreams shared by routes with and without route-level authentication. Check the upstream path-normalization behavior against Apache's stated condition.
-
Prioritize deployments meeting the advisory conditions
Give priority to versions 0.9 through 3.19.0 where a protected and unprotected route share an upstream. As interim defensive guidance, review whether those routes should share the same upstream and restrict access to sensitive routes where feasible.
-
Upgrade affected APISIX instances
Follow Apache's recommendation to move affected instances to version 3.20.0. Confirm the appropriate deployment and compatibility steps for each installation before rollout.
-
Verify the running version and route policy
After deployment, record the running APISIX version and confirm it is 3.20.0 or later. Recheck authentication plugin placement and upstream behavior, then review access records for unexpected attempts to reach protected resources.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124680 in Apache APISIX?
Apache describes a route-level authentication bypass caused by a path interpretation conflict between routing and upstream forwarding. Specific shared-upstream and path-handling conditions must be present.
Which APISIX version fixes CVE-2026-124680?
Apache recommends version 3.20.0. It lists versions 0.9 through 3.19.0 as affected, so verify the running version after an upgrade.
Does every affected APISIX version expose protected routes?
A version match is only one part of the exposure check. Apache also specifies shared authenticated and unauthenticated routes and an upstream that does not collapse encoded dot segments.
What does the Blackhole mention establish?
Brandefense Blackhole counted one dark-chat post mentioning this CVE from 16 August through 14 November 2026. A discussion record does not verify exploitation or compromise.
Sources
- CVE-2026-124680: Apache APISIX route-level authentication bypassApache Software Foundation
- CVE-2026-124680 recordNIST NVD
- Known Exploited Vulnerabilities catalogCISA
