Not rated
CVE-2020-13945 In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
Description
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache APISIX | 1.5 | No fix stated |
| Apache APISIX | 1.4 | No fix stated |
| Apache APISIX | 1.3 | No fix stated |
| Apache APISIX | 1.2 | No fix stated |
References
- lists.apache.org lists.apache.org
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Last modified
Other CVEs of Apache APISIX
The 34 CVEs of Apache APISIX →
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX
5.1
Medium
CVE-2026-94269
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX
6.3
Medium
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX
8.2
High
CVE-2026-94220
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX
2.1
Low