CVE-2022-24112

CVE-2022-24112 is a critical-severity vulnerability in Apache Apisix with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-08-25). The underlying weakness is classified as CWE-290.

Key facts

Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Frequently asked questions

What is CVE-2022-24112?
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
How severe is CVE-2022-24112?
CVE-2022-24112 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-24112 being actively exploited?
Yes. CVE-2022-24112 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-08-25, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2022-24112?
CVE-2022-24112 affects Apache Apisix. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-24112?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2022-24112 have an EU (EUVD) identifier?
Yes. CVE-2022-24112 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-29024. It is also flagged as exploited in the EUVD (since 2022-08-25).
When was CVE-2022-24112 published?
CVE-2022-24112 was published on 2022-02-11 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Apache Apisix

All CVEs affecting Apache Apisix →

Other CWE-290 vulnerabilities

Browse all CWE-290 vulnerabilities →