CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
Description
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache APISIX: from 3.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
INFO
Published Date :
Aug. 26, 2026, 11:34 a.m.
Last Modified :
Aug. 26, 2026, 11:34 a.m.
Remotely Exploit :
Yes !
Source :
apache
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | f0158376-9dc2-43b6-827c-5f631a4d8d09 |
Solution
- Upgrade Apache APISIX to version 3.18.0.
- Apply sanitization fixes to the attach-consumer-label plugin.
- Validate user input sanitization.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63041 vulnerability anywhere in the article.