How severe is CVE-2026-94269?

CVE-2026-94269 has a CVSS 4.0 base score of 6.3, rated medium severity.

Is CVE-2026-94269 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-94269?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-94269 published?

CVE-2026-94269 was published on 2026-10-01.

CVE-2026-94269

CVE-2026-94269 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-647.

Key facts

Severity: Medium (CVSS 4.0 base score 6.3)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-647
Published: 2026-10-01
Last modified: 2026-10-01

Description

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Frequently asked questions

What is CVE-2026-94269?: Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.
How severe is CVE-2026-94269?: CVE-2026-94269 has a CVSS 4.0 base score of 6.3, rated medium severity.
Is CVE-2026-94269 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-94269?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-94269 published?: CVE-2026-94269 was published on 2026-10-01.

References

Other CWE-647 vulnerabilities

CVE-2026-80515 — High (CVSS 8.9): In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/……
CVE-2022-43939 — High (CVSS 8.6): Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security…
CVE-2026-59731 — High (CVSS 8.2): Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially…
CVE-2026-62685 — High (CVSS 8.1): File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a…
CVE-2025-64500 — High (CVSS 7.3): Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's…
CVE-2025-9909 — Medium (CVSS 6.7): A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows…

Browse all CWE-647 vulnerabilities →