Description
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.

tencent-cloud-cls log export uses plaintext HTTP
This issue affects Apache APISIX: from 2.99.0 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Published: 2026-04-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cleartext transmission of sensitive information
Action: Patch
AI Analysis

Impact

The vulnerability in Apache APISIX allows the tencent-cloud-cls log export plugin to transmit log data over unencrypted HTTP, exposing sensitive information in cleartext. This flaw permits an attacker to intercept the log traffic and view its contents, potentially revealing confidential data. The weakness maps to data being sent without encryption (CWE‑319) and does not lead to code execution or denial of service.

Affected Systems

Apache APISIX, released by the Apache Software Foundation, is affected in versions 2.99.0 through 3.15.0. Deployments that use the tencent-cloud-cls log export plugin in these versions are vulnerable unless mitigated.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% signals a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network eavesdropper able to capture HTTP traffic between an APISIX instance and the Tencent Cloud CLS service, thereby obtaining the unencrypted log data.

Generated by OpenCVE AI on April 14, 2026 at 21:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache APISIX to version 3.16.0 or later as released by the vendor
  • Verify that outbound log traffic to Tencent Cloud CLS no longer uses HTTP
  • Monitor network traffic for any remaining plaintext log transmissions
  • Keep Apache APISIX and its plugins updated regularly

Generated by OpenCVE AI on April 14, 2026 at 21:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Apr 2026 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*

Tue, 14 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apisix
Vendors & Products Apache
Apache apisix

Tue, 14 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
References

Tue, 14 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
Description Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.
Title Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
Weaknesses CWE-319
References

Subscriptions

Apache Apisix
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-04-14T19:51:55.994Z

Reserved: 2026-03-10T12:14:05.125Z

Link: CVE-2026-31924

cve-icon Vulnrichment

Updated: 2026-04-14T08:37:18.355Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-14T09:16:35.953

Modified: 2026-04-17T18:38:47.130

Link: CVE-2026-31924

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T15:30:06Z

Weaknesses