Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/apisix
master @ 3494117
102
Fixes
13
CVEs
CRITICAL
Peak severity
34.4%
Coverage
Highlights
Auth Bypass: 34 prior fixes. Scrutinize any change in this area.
apisix/init.lua: most-fixed (8 issues). Treat as high-risk during review.
44 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The JWT authentication plugin has faced critical vulnerabilities involving algorithm confusion (HMAC/Asymmetric key confusion), missing/empty configuration validation, and user payload parameter merging that allowed attackers to override token properties.
Authentication Bypass: Bypassing IP-based routing restrictions through subrequest dispatchers. Subrequests failed to inherit or propagate the real client IP, leading to remote code execution and administrative bypasses (e.g., CVE-2022-24112).
Auth Bypass: Flaws in TLS/mTLS verification, such as failure to validate that the HTTP Host matches the SNI presented, or cached verification state leakage, allowed clients to bypass certificate validation entirely.