Description
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX.

A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach.


This issue affects Apache APISIX: from 2.11.0 through 3.17.0.



Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Published: 2026-08-27
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper neutralisation of special elements in LDAP queries within the ldap-auth plugin of Apache APISIX. A user who has valid credentials for one LDAP entry can construct a request that causes the plugin to authenticate them as a different consumer whose identity was not intended to be reachable under the plugin's configured scope. This results in successful impersonation and unauthorized access to services protected by APISIX.

Affected Systems

Affected products are Apache APISIX users running versions from 2.11.0 through 3.17.0. The vendor is the Apache Software Foundation, and the vulnerability exists in the ldap-auth plugin. All deployments that rely on this plugin within the specified version range are susceptible.

Risk and Exploitability

The CVSS base score of 7 indicates a high severity. Because an attacker only needs a valid credential for another LDAP entry and the plugin lacks proper query sanitisation, the exploit is relatively straightforward. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA's KEV catalog, but the high CVSS and potential for credential hopping warrant immediate attention.

Generated by OpenCVE AI on August 27, 2026 at 10:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache APISIX to version 3.18.0 or later, which includes the fix for the LDAP injection issue.
  • If a version upgrade cannot be performed immediately, limit the ldap-auth plugin to trusted network segments and enforce least‑privilege credentials so that users cannot use valid LDAP credentials to map to unintended consumers.
  • Consider disabling or re‑configuring the ldap-auth plugin to use parameterised LDAP queries, and audit authentication logs for unexpected consumer mapping activities.

Generated by OpenCVE AI on August 27, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apisix
Vendors & Products Apache
Apache apisix

Thu, 27 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects Apache APISIX: from 2.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Title Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Weaknesses CWE-90
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Apache Apisix
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-27T12:09:54.558Z

Reserved: 2026-08-17T13:31:18.541Z

Link: CVE-2026-75020

cve-icon Vulnrichment

Updated: 2026-08-27T10:22:05.647Z

cve-icon NVD

Status : Received

Published: 2026-08-27T10:16:36.620

Modified: 2026-08-27T13:18:37.243

Link: CVE-2026-75020

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T11:30:04Z

Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')