CVE-2026-94212

Published 1 October 2026 · tracked since 2 October 2026

Description

Improper verification of cryptographic signature vulnerability in Apache APISIX.Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.Users are recomme

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-103686 LOW 3.5
• CVE-2026-102504 HIGH 7.5
• CVE-2026-103067 HIGH 8
• CVE-2026-94250
• CVE-2026-94269
• CVE-2026-94276
• CVE-2026-94220
• CVE-2026-82806
• CVE-2026-88789 HIGH 8.6
• CVE-2026-78242

→ Open the live CVE board · all tools