Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-24112

CVE-2022-24112CRITICAL

Apache Software Foundation Apache APISIX — apisix/batch-requests plugin allows overwriting the X-REAL-IP header

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9607   99.9   YES

AFFECTED
  Product        Versions              Fixed
  Apache APISIX  Apache APISIX 2.12 –  —

TIMELINE
  Jan 28  Reserved by apache
  Feb 11  Published (CNA: apache)
  Aug 25  Added to CISA KEV, remediation due 2022-09-15

CWE-290 · CNA: apache · CVSS v3.1 · 5 references · KEV due September 15, 2022

Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 28, 2022	Reserved	Reserved by apache
February 11, 2022	Published	Published (CNA: apache)
August 25, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-09-15

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Apache Software Foundation	Apache APISIX	—	Apache APISIX 2.12	—

Weaknesses

CWE-290

References (5)

http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html [x_refsource_MISC]
http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html [x_refsource_MISC]
http://www.openwall.com/lists/oss-security/2022/02/11/3 [mailing-list, x_refsource_MLIST]
https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94 [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112 [government-resource]

Authoritative record: CVE-2022-24112 at cve.org

Vendors: apache

Weaknesses: CWE-290

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-24112 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.