ZeroDay Findings
Sign inSign up

Findings

CVE-2022-24112

Apache APISIX Authentication Bypass Vulnerability

Published Feb 11, 2022 · updated Jun 16, 2026 · apache apisix

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 11, 2022 · Catalog

    Detected

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of

  2. Aug 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Sep 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of

Required action

Apply updates per vendor instructions.

CISA due date Sep 15, 2022

Affected

  • cpe apache/apisixversion unspecified
  • vendor Apache APISIXversion unspecified

Sources

  • CISA KEVCVE-2022-24112

    Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

    cisa.gov
  • CVE.orgCVE-2022-24112

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-24112

    30-day exploitation probability 96.1%

    first.org
  • Exploit Database50829

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/apache_apisix_api_default_token_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-24112

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed

    nvd.nist.gov

References