CVE-2026-82806 — Apache APISIX: cross-request permission pollution via static permission list mutation

CVE-2026-82806

Apache APISIX: cross-request permission pollution via static permission list mutation PUBLISHED

Description (CNA)

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache APISIX	affected 2.3.0 before 3.7.0

CWE

CWE-488

References

https://lists.apache.org/thread.html/wvkv2b4oy2fh9v79d30gtsy0bhqmzcdd

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/01/3

CISA-ADP

No English description supplied.

No references supplied.