CVE-2026-75020 is an LDAP injection flaw (CWE-90) in Apache APISIX. A caller with valid credentials for one directory entry can authenticate as a consumer mapped to another entry. The record rates it High at 8.1. Apache says upgrade to version 3.18.0.
What's affected
Apache says APISIX from 2.11.0 through 3.17.0 is affected and recommends upgrading to 3.18.0. The announcement credits MopMonk AI as reporter.
It affects deployments that authenticate consumers through the LDAP plugin. The record scores it 8.1 (High), with network access, low privileges, and high impact on confidentiality and integrity. Apache and the record agree on versions and fix.
How to check if you're exposed
Find the version of APISIX on each gateway.
apisix version
For containers, check the image tag. Then review your routes with the plugin named in this CVE, since only routes that use it are in the path. You can list routes through the Admin API or in your configuration files.
Then look for routes that use the LDAP authentication plugin, and check how consumers are mapped to directory entries.
What to do now
- Upgrade Apache APISIX to 3.18.0.
- List routes and consumers that rely on LDAP authentication.
- Review which directory entries are mapped to privileged consumers, and keep the scope of the plugin as narrow as possible.
- Look through gateway access logs for a consumer that authenticated unexpectedly.
- Add a test to confirm that user A cannot authenticate as consumer B.
Why it matters
The weakness is improper neutralisation of special elements in an LDAP query, CWE-90. LDAP filters use characters with special meaning. If the application inserts user input into a filter without escaping, the person can alter the filter and change which entry matches. Apache's wording is that a caller who holds valid credentials for one entry can authenticate as a consumer mapped to a different entry, one the configured scope was meant to keep out of reach.
The result is horizontal or vertical privilege change at the gateway, which sits in front of many services. Escaping filter values, or using a library function that does it, is the standard defence. KEV status is false.
Quick check
Do I need valid credentials to exploit it?
Apache's description says the caller holds valid credentials for one directory entry, so a login is needed.
What is the fixed version?
Apache recommends 3.18.0.
Sources
Last reviewed: 18 October 2026.
