CVE-2026-124726

An MCP call could reach API paths missing from the tool definition

Apache Software Foundation · APISIX OpenAPI-to-MCP plugin

First documented disclosure · Review checkpoint

Summary

The gateway failed to confine the destination of a tool call to paths declared in the route’s OpenAPI specification. The request could reach another API path using the method and credentials assigned to the declared route.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The gateway failed to confine the destination of a tool call to paths declared in the route’s OpenAPI specification.

Conditions required

A caller could invoke an exposed MCP tool on an affected route.

Potential impact

The request could reach another API path using the method and credentials assigned to the declared route.

Affected versions and configurations

3.19.0 through versions before 3.20.0.

Fix and mitigation status

3.20.0.

Practical next steps

Upgrade APISIX to 3.20.0 or later and review the privileges attached to MCP routes.

Operating lesson

Enforce the declared API path after resolving every tool request.

Evidence and limits

The advisory and CVE record were published on 2026-11-13.

Sources