How severe is CVE-2026-82806?

CVE-2026-82806 has a CVSS 4.0 base score of 5.3, rated medium severity.

Is CVE-2026-82806 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-82806?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-82806 published?

CVE-2026-82806 was published on 2026-10-01.

CVE-2026-82806

CVE-2026-82806 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-488.

Key facts

Severity: Medium (CVSS 4.0 base score 5.3)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-488
Published: 2026-10-01
Last modified: 2026-10-01

Description

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.

Frequently asked questions

What is CVE-2026-82806?: Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.
How severe is CVE-2026-82806?: CVE-2026-82806 has a CVSS 4.0 base score of 5.3, rated medium severity.
Is CVE-2026-82806 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-82806?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-82806 published?: CVE-2026-82806 was published on 2026-10-01.

References

Other CWE-488 vulnerabilities

CVE-2026-16326 — Critical (CVSS 10.0): In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
CVE-2026-16498 — Critical (CVSS 10.0): The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the…
CVE-2026-19931 — Critical (CVSS 9.8): A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication,…
CVE-2025-47928 — Critical (CVSS 9.1): Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using…
CVE-2024-27455 — Critical (CVSS 9.1): In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token…
CVE-2026-86492 — High (CVSS 8.5): In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation…

Browse all CWE-488 vulnerabilities →