CVE-2026-75020: 
Apache APISIX vulnerability analysis and mitigation

CVE-2026-75020 is an LDAP Injection vulnerability (CWE-90) in Apache APISIX's ldap-auth plugin, enabling cross-subtree identity impersonation. An authenticated caller with valid LDAP credentials for one directory entry can manipulate LDAP queries to authenticate as a different consumer identity that the plugin's configured scope was intended to restrict. The vulnerability affects Apache APISIX versions 2.11.0 through 3.17.0 and was publicly disclosed on August 26, 2026, with a fix available in version 3.18.0. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.0 (High) (Apache Advisory, GitHub Advisory).

The root cause is improper neutralization of special elements in LDAP queries constructed by the ldap-auth plugin (CWE-90, CAPEC-136). When a user authenticates, the plugin builds an LDAP query using user-supplied input without adequately sanitizing LDAP metacharacters, allowing an attacker to inject filter logic that redirects the authentication lookup to a different directory entry outside the plugin's intended scope. Exploitation requires the attacker to already hold valid LDAP credentials for at least one directory entry, after which they can craft a malicious authentication request to impersonate a consumer mapped to a restricted subtree. The vulnerability was reported by MopMonk AI and disclosed via the Apache oss-security mailing list (oss-security, GitHub Advisory).

Successful exploitation allows an authenticated attacker to bypass APISIX consumer-level access controls and impersonate a different consumer identity — including those explicitly excluded by the plugin's configured LDAP scope — resulting in high confidentiality and integrity impact on downstream systems. An attacker could gain unauthorized access to APIs, backend services, or data that the impersonated consumer is permitted to reach, potentially enabling lateral movement within the API gateway's protected environment. Availability is not directly impacted by this vulnerability (Apache Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.46–0.54%, placing it in the 44th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid LDAP credentials, which limits the attacker pool but does not eliminate risk in environments with multiple LDAP users.

1. Reconnaissance: Identify an Apache APISIX instance (versions 2.11.0–3.17.0) configured with the ldap-auth plugin by probing API endpoints or reviewing exposed configuration metadata.
2. Obtain valid LDAP credentials: Acquire legitimate credentials for any LDAP directory entry within the APISIX-connected directory — this could be a low-privilege account.
3. Craft malicious authentication request: Construct an authentication request to APISIX where the username field contains LDAP injection metacharacters (e.g., *, )(, or filter-closing sequences) designed to alter the LDAP search filter and match a different, higher-privileged directory entry.
4. Submit injected request: Send the crafted request to the APISIX authentication endpoint. The plugin constructs an LDAP query using the unsanitized input, causing the directory server to return a different entry than intended.
5. Authenticate as target consumer: APISIX maps the returned LDAP entry to the corresponding consumer identity, granting the attacker access as that consumer — including access to routes and upstream services restricted to that identity (oss-security, GitHub Advisory).

• Network: Unusual authentication requests to APISIX endpoints from known low-privilege LDAP accounts accessing routes or upstreams associated with higher-privilege consumers; unexpected cross-consumer API calls.
• Logs: APISIX access logs showing a single LDAP username successfully authenticating as multiple distinct consumer identities; LDAP query logs on the directory server containing unexpected filter syntax (e.g., wildcard characters *, unbalanced parentheses, or injected filter clauses in the uid or cn attribute field).
• Logs: Authentication events where the LDAP bind succeeds for one DN but the resulting consumer mapping resolves to a different, unrelated DN or subtree.
• Process/Application: APISIX plugin logs reflecting LDAP search results returning entries outside the configured base_dn or search_filter scope.

The primary remediation is to upgrade Apache APISIX to version 3.18.0, which contains the fix for this vulnerability (Apache Advisory). For environments that cannot immediately patch, administrators should audit all consumer mappings in APISIX to identify any anomalous identity associations, restrict LDAP directory entries with valid credentials to the minimum necessary, and consider temporarily disabling the ldap-auth plugin on sensitive routes until the upgrade is applied. Additionally, enabling detailed LDAP query logging on the directory server can help detect injection attempts during the interim period.

The vulnerability was noted on the Bluesky infosec community feed shortly after disclosure, and security aggregators including VulDB, Vulners, and OSV.dev indexed it promptly. A third-party advisory from Brinztech characterized it as a "critical LDAP injection vulnerability" in their breach alert coverage (Brinztech). The vulnerability was credited to MopMonk AI as the reporter, per the oss-security disclosure (oss-security).