CVE-2026-124726

Published 13 November 2026 · tracked since 14 November 2026

Description

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-125795 CRITICAL 9.8
• CVE-2026-125771 HIGH 7.2
• CVE-2026-129482 MEDIUM 4.8
• CVE-2026-125449 HIGH 8.8
• CVE-2026-122662 CRITICAL 9.8
• CVE-2026-82663 HIGH 7.5
• CVE-2026-82568 HIGH 7.5
• CVE-2026-129349
• CVE-2026-129444 CRITICAL 10
• CVE-2026-129443 MEDIUM 6.3

→ Open the live CVE board · all tools