CVE-2026-48895: Apisix Unconditional Admin Route Bind

Unconditional binding of Admin API routes directly from core configuration detected. In Apache APISIX, this may inadvertently expose ETCD-backed routes when running in standalone (YAML) mode, leading to authentication bypass or deserialization exploits if default unauthenticated states are triggered. Ensure that routes enforce configuration provider segregat

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0lua
greprules fetch cve-2026-48895-apisix-unconditional-admin-route-bind --engine opengrep

Description

Unconditional binding of Admin API routes directly from core configuration detected. In Apache APISIX, this may inadvertently expose ETCD-backed routes when running in standalone (YAML) mode, leading to authentication bypass or deserialization exploits if default unauthenticated states are triggered. Ensure that routes enforce configuration provider segregat