CVE-2022-24112: Apache APISIX Admin API bypass leading to remote code execution, actively exploited
The short version: Apache APISIX has a flaw in its batch-requests plugin (CVE-2022-24112) that lets an attacker bypass the Admin API's IP restriction. On a default configuration — Admin API enabled with the shipped default admin key — that bypass leads straight to unauthenticated remote code execution. It's in CISA's KEV catalog. Patch, and change the default admin key. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — default configurations are remotely code-executable |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~96.18% · 99.87th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-09-15 |
| Known exploited? | Yes — public exploit code; CISA-listed as exploited |
| Vulnerability type | CWE-290 authentication bypass by spoofing → Admin API IP-restriction bypass → RCE on default config |
| Requires authenticated session? | No — pre-authentication (default admin key is public) |
| Affected | APISIX 1.3 through 2.12.0 (excluding 2.12.1); LTS 2.10.0 through 2.10.3 (excluding 2.10.4) |
| Fixed in | APISIX 2.12.1 · 2.10.4 (LTS) |
What you need to know
Apache APISIX is a cloud-native API gateway. The batch-requests plugin is supposed to preserve the real client IP so the Admin API's IP allow-list can be enforced. A bug in that check lets an attacker spoof past the restriction and invoke the Admin API as though they were trusted.
That matters because of what the Admin API can do:
- On default config, it's game over. APISIX ships with a well-known default admin key. If it hasn't been changed and the Admin API is reachable, the bypass turns into unauthenticated remote code execution.
- Even hardened setups take a hit. If the admin key was changed or the Admin API moved to a separate port, the impact is lower — but the plugin can still be used to bypass IP restrictions on the data plane.
- It's automatable and exploited. Public exploit code exists and CISA lists it as exploited, so exposed default installs are a standing target.
How serious we see it
High — for the common case.
The base score is 9.8, and the reason we don't discount it is that the dangerous precondition — the default admin key — is exactly what ships out of the box. A default APISIX with a reachable Admin API is remotely code-executable by an unauthenticated attacker, and it's in KEV. The bounded, reassuring part: the fix is published, changing the admin key and restricting the Admin API removes the sharp edge, and you can confirm your version and exposure quickly.
Recommendations
Straight from the Apache APISIX advisory and CISA:
- Patch now. Upgrade to APISIX 2.12.1 or 2.10.4 (LTS) or later.
- Change the default admin key. Never run the Admin API with the shipped default key.
- Restrict and isolate the Admin API. Keep it off the public internet and, where possible, on a separate port from the data plane.
- If you can't patch immediately, disable batch-requests. Comment out
batch-requestsinconf/config.yaml/conf/config-default.yamland restart, per the vendor. - Confirm your exposure first. Verify whether an APISIX Admin API is internet-reachable and which version you run.
How BreachRisk sees it
BreachRisk discovers internet-facing APISIX gateways the way an attacker would — from little more than your domain — fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one, surfaced at the top of your results because it's in KEV.
That outside-in view is exactly what you want for a default-config flaw: the exposed gateway is already on your map, so you can go straight to patching and rotating the admin key rather than discovering it after someone else did.