CVE-2026-63041 — Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypa…
Published: 2026-08-26 · CVSS: 5.3 · CVSS 4.0
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache APISIX: from 3.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7