Apache APISIX 3.20.0 security fixes address seven disclosed authorization, identity and MCP trust-boundary flaws. Apache recommends 3.20.0 for each affected branch. The affected configurations differ, so inventory routes and plugins before treating every gateway as equally exposed.
Apache published the release on November 11, 2026, and its individual advisories appeared on November 13. Two of the flaws can affect requests without authentication under specific route settings. The release also changes several authentication and routing behaviors that need regression testing.
Which Apache APISIX 3.20.0 Security Fixes Affect Your Routes?
The table maps each Apache advisory to the configuration that creates exposure. All seven advisories name 3.20.0 as the fixed release. Their CVSS 4.0 scores come from Apache; the opened notices do not give CVSS 3.1 scores.
| Advisory and CVSS 4.0 | Affected versions | Relevant route or plugin condition | Fixed version |
|---|---|---|---|
| CVE-2026-124680, 7.0 high | 0.9 to 3.19.0 | An unauthenticated route and an authenticated route share an upstream; that upstream retains encoded dot segments. | 3.20.0 |
| CVE-2026-124679, 7.8 high | 3.18.0 to 3.19.0 | jwe-decrypt uses strict: false with a forward_header distinct from the token header, or forward-auth uses allow_degradation: true while the authorization service is unavailable. | 3.20.0 |
| CVE-2026-124666, 6.4 medium | 3.8.0 to 3.19.0 | multi-auth falls back from wolf-rbac while an upstream trusts Wolf identity headers. | 3.20.0 |
| CVE-2026-124716, 6.4 medium | 1.4.0 to 3.19.0 | authz-keycloak requires several permissions or scopes, but a user has only one. | 3.20.0 |
| CVE-2026-124719, 2.3 low | 3.19.0 | openapi-to-mcp route identity headers overlap headers declared in its OpenAPI document. | 3.20.0 |
| CVE-2026-124723, 6.3 medium | 3.18.0 to 3.19.0 | match_uri_encoded_slash and skip_mtls_uri_regex are enabled, and the request path decodes to an exempted URI. | 3.20.0 |
| CVE-2026-124726, 6.9 medium | 3.19.0 | An MCP caller can reach an undeclared API path under the declared tool’s HTTP method, using Route-added credentials. | 3.20.0 |
The first two flaws have different mechanics. For CVE-2026-124680, routing and upstream forwarding interpret a path differently. For CVE-2026-124679, an upstream may receive a client-supplied identity value when authentication did not establish one.
A vulnerability intelligence platform can help prioritize the affected gateway inventory against exposed services. The vulnerability intelligence glossary explains the broader triage process.
What Should APISIX Operators Do Now?
Upgrade affected gateways to 3.20.0 and validate the running version on every instance. Apache’s release notes also describe behavior changes that can reject previously accepted requests. Test the applicable plugins before production rollout.
- Inventory APISIX versions and the affected Route, Service and plugin configurations.
- Prioritize shared upstreams, degraded authentication paths and identity headers trusted downstream.
- Test authorized and unauthorized requests against each configured authentication fallback.
- Review Keycloak permission sets, mTLS exemptions and MCP tool boundaries before rollout.
- Upgrade to 3.20.0, confirm each instance runs it and retest the same cases.
Apache says wolf-rbac moves custom header_prefix from Consumer to Route or Service. The release also requires every configured Keycloak permission and scope. Operators using either plugin should migrate configuration and test both successful and fallback authentication.
For openapi-to-mcp, declare legitimate parameters in the OpenAPI document and check browser origins, external references and header precedence. The release removes the deprecated mcp-bridge plugin, so deployments using it need a separate migration. An incident response plan template can assign owners for gateway validation and log review.
How Should Teams Interpret the Current Risk Picture?
Brandefense Blackhole counted one dark-chat post mentioning CVE-2026-124680 and one mentioning CVE-2026-124679 from August 16 to November 14, 2026. The unit is posts, not incidents or distinct actors. The two counts may overlap and do not establish successful exploitation.
As of the November 13 CISA catalog snapshot, neither CVE appeared in Known Exploited Vulnerabilities. That dated catalogue result does not assess the other five issues or prove their absence from attacks. Preserve gateway and upstream authorization logs while verifying the patch and route behavior.
- Brandefense BlackholeYesOne matching dark-chat post for each of CVE-2026-124680 and CVE-2026-124679; counts may overlap2026-11-14
- CISA KEVNot seenNeither queried CVE listed in catalog snapshot 2026.11.132026-11-13
Frequently Asked Questions
Which APISIX version fixes the seven issues?
Apache recommends APISIX 3.20.0 for each advisory. Verify the running version on every gateway after upgrading.
Does every APISIX deployment meet every exploit condition?
No. The advisories describe different affected versions and route or plugin settings. Compare each gateway configuration with the table before prioritizing.
