CVE-2026-63041 is a high severity (CVSS 8.8) flaw in Apache APISIX 3.11.0 through 3.17.0. The attach-consumer-label plugin does not sanitise certain values, so an attacker can escalate privilege or bypass authorization. The record says to upgrade to 3.18.0, though one source shows the fix version as pending.
What's affected
The record and the Apache announcement agree that Apache APISIX 3.11.0 through 3.17.0 is affected. The weakness is CWE-807 (reliance on untrusted inputs in a security decision). The CVSS vector is network based, low complexity, low privileges, with high impact on confidentiality, integrity and availability.
Source conflict on the fix. The record says users should upgrade to version 3.18.0. The oss-security announcement of 26 August 2026 says the fix is in version pending, which is a placeholder in the mailing list text. The mailing list subject line describes the problem as the plugin not stripping client supplied consumer-label headers. Check the Apache APISIX release page for 3.18.0 before you plan the upgrade.
The announcement credits the reporter and gives no workaround.
How to check if you're exposed
Find the APISIX version and whether the plugin is in use.
apisix version
grep -rn "attach-consumer-label" conf/ 2>/dev/null
curl -s http://127.0.0.1:9180/apisix/admin/routes -H "X-API-KEY: $ADMIN_KEY" | grep -c attach-consumer-label
If you do not use the attach-consumer-label plugin on any route, global rule or consumer, the vulnerable code is not in your request path, but you should still plan the upgrade. If it is in use, look at which upstream services trust the labels it sets. Those services are where a forged value would do harm.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Check the version on every gateway node and list routes that enable attach-consumer-label.
- Upgrade to Apache APISIX 3.18.0 once you have confirmed it on the project's release page.
- Until then, consider disabling the plugin on routes where upstream services rely on its headers for access decisions. This is a general precaution, not an instruction from the advisory.
- Have upstream services check the consumer identity from the gateway's authenticated context where possible, and not from a header a client could set.
- Review access logs for requests that carry consumer label headers from outside your network.
Why it matters
This is a trust boundary problem. A gateway authenticates a caller, then tells backend services who the caller is, often through a header. If a client can also supply that header, and the gateway does not remove or overwrite it, the backend cannot tell real values from forged ones. The class is CWE-807.
Because the gateway sits in front of many services, one mistake here can affect all of them. The record does not mark this CVE as exploited in the wild, and it is not in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fixed version confirmed?
The record names 3.18.0. The oss-security text shows the fix version as pending, so confirm 3.18.0 on the Apache APISIX release page.
Sources
Last reviewed: 18 October 2026.
