Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 21:14:40 +0000 CVE-2026-124726 — Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare https://db.gcve.eu/vuln/cve-2026-124726 <p><strong>Affected:</strong> Apache Software Foundation Apache APISIX</p> <p>Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.</p> <p>A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool&#39;s HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.</p> <p>Users are recommended to upgrade to version 3.20.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache APISIX</p> <p>Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.</p> <p>A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool&#39;s HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.</p> <p>Users are recommended to upgrade to version 3.20.0, which fixes the issue.</p> https://db.gcve.eu/vuln/cve-2026-124726