Apache APISIX’s tencent-cloud-cls plugin transmits log data over plain text HTTP, which allows an adversary to intercept and read any sensitive information contained within the logs. This clear‑text data transfer is a classic CWE‑319 vulnerability that exposes confidentiality information without permitting code execution or denial of service. An attacker who can observe the network between APISIX and the CLS endpoint can capture log payloads, potentially revealing user data or diagnostic details.

Systems running Apache APISIX versions 2.99.0 through 3.15.0 are affected. These versions include the default configuration of the tencent-cloud-cls plugin and are distributed by the Apache Software Foundation. Upgrading to 3.16.0 removes the insecure HTTP transport and implements secure logging.

Because the flaw relies on plain HTTP transmission, any network path that an attacker can monitor—such as an internal network or a compromised router—can be used to capture logs. There is no known authentication bypass required to exploit the flaw; the attack requires simply observing traffic. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate exploitation risk, but the exposure of potentially sensitive log records makes it a critical concern for organizations that maintain strict confidentiality requirements.