CVE-2026-31924: 
Apache APISIX vulnerability analysis and mitigation

CVE-2026-31924 is a Cleartext Transmission of Sensitive Information vulnerability (CWE-319) in Apache APISIX, where the tencent-cloud-cls log export plugin transmits log data over plaintext HTTP instead of encrypted HTTPS. It affects Apache APISIX versions 2.99.0 through 3.15.0. The vulnerability was discovered by Oleh Konko and disclosed on April 14, 2026, via the Apache security mailing list and the OSS-Security list. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, OSS-Security).

The root cause is classified as CWE-319 (Cleartext Transmission of Sensitive Information): the tencent-cloud-cls plugin, used to export logs to Tencent Cloud CLS (Cloud Log Service), establishes connections over unencrypted HTTP rather than HTTPS. An attacker with a network-level position between the APISIX instance and the Tencent Cloud CLS endpoint — such as on the same network segment or via a compromised intermediate node — can passively intercept and read the transmitted log data. No authentication or user interaction is required to exploit this weakness; the attacker simply needs to be able to sniff the relevant network traffic (GitHub Advisory, OSS-Security).

An attacker positioned to intercept network traffic between an affected Apache APISIX instance and Tencent Cloud CLS could eavesdrop on sensitive log data transmitted in cleartext. Application logs may contain authentication credentials, session tokens, API keys, or other sensitive operational data, depending on what the application logs during normal operation. The impact is limited to confidentiality (no integrity or availability impact), but exposure of credentials or tokens could enable further lateral movement or account compromise (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-adjacent or on-path attacker position, which limits opportunistic exploitation (GitHub Advisory, OSS-Security).

1. Reconnaissance: Identify Apache APISIX deployments running versions 2.99.0 through 3.15.0 with the tencent-cloud-cls plugin enabled and configured to export logs to Tencent Cloud CLS.
2. Network Positioning: Gain a network-adjacent or on-path position between the APISIX instance and the Tencent Cloud CLS endpoint (e.g., via ARP spoofing, rogue access point, compromised network device, or access to a shared network segment).
3. Traffic Interception: Use a packet capture tool such as tcpdump or Wireshark to capture HTTP traffic on the relevant network interface or segment.
4. Log Data Extraction: Filter captured traffic for HTTP requests destined for the Tencent Cloud CLS API endpoint. Since the data is transmitted in plaintext, log contents — potentially including credentials, tokens, or other sensitive application data — can be read directly from the captured packets (GitHub Advisory, OSS-Security).

The Apache Software Foundation has released Apache APISIX version 3.16.0, which resolves this vulnerability by securing the tencent-cloud-cls log export plugin to use HTTPS. All users running versions 2.99.0 through 3.15.0 should upgrade to 3.16.0 or later as the primary remediation. As an interim measure prior to patching, administrators should implement network segmentation to restrict access to log export traffic paths, and review logs exported during the vulnerable period for potential sensitive data exposure (GitHub Advisory, OSS-Security).

The vulnerability was reported to the OSS-Security mailing list by Abhishek Choudhary on April 14, 2026, crediting Oleh Konko as the finder. Coverage has been limited to standard vulnerability tracking databases and aggregators, with no notable researcher commentary or significant community discussion observed beyond routine disclosure channels (OSS-Security).