https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:41:01.500840+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-apisix-2026-31923 BIT-apisix-2026-31923 — Apache APISIX: Openid-connect `tls_verify` field is disabled by default 2026-10-06T16:41:01.562327+00:00

Affected: Bitnami: apisix

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.

This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-291344 EUVD-2026-291344 2026-10-06T16:41:01.562384+00:00 EUVD-2026-291344 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31923 fkie_cve-2026-31923 2026-10-06T16:41:01.562402+00:00

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.

This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-j648-xxf5-44cv GHSA-j648-xxf5-44cv 2026-10-06T16:41:01.562428+00:00

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.

This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.