CVE-2026-75020 HIGH

CVE-2026-75020: Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Vendor Apache Software Foundation

Product Apache APISIX

Weakness CWE-90 · LDAP injection

Published August 27, 2026

Last update August 27, 2026

View on NVD All CVEs

CVSS base score

7.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects Apache APISIX: from 2.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Key dates

02Disclosure timeline

August 27, 2026 CVE published

August 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-75020 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/90.html AskarLabs — CWE-90 write-up LDAP Injection

Related vulnerabilities

Identifiers

CVE CVE-2026-75020

CWE CWE-90

CVSS 7.0 / HIGH

Affected versions