CVE-2026-78242

Apache APISIX: data-mask may fail to redact request headers in logger output

Apache Software Foundation Apache APISIX

CVSS

5.7Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published1 Oct 2026Updated 1 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Insertion of sensitive information into log file vulnerability in Apache APISIX.

This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure.

This issue affects Apache APISIX: 3.17.0.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Text from CVE List