Not rated
Exploited
CVE-2022-24112 Apache APISIX Authentication Bypass Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-290
Description
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache APISIX 2.12 | earliest → < 2.12.1 | 2.12.1 |
| Apache APISIX 2.10 | earliest → < 2.10.4 | 2.10.4 |
| Apache APISIX 1.3 | 1.3 → latest | No fix stated |
References
- lists.apache.org lists.apache.org
- [oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header www.openwall.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Apache APISIX
The 34 CVEs of Apache APISIX →
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX
5.1
Medium
CVE-2026-94269
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX
6.3
Medium
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX
8.2
High
CVE-2026-94220
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX
2.1
Low