CVE-2020-13945: Apache APISIX Admin API default token exposes management data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw exposes gateway management data over the network with a default token, and although CVSS is medium, EPSS is very high and an exploit reference exists.

What it is

Apache APISIX versions 1.2 through 1.5 allow access to the Admin API using a default token when the Admin API is enabled and its access IP restriction rules have been deleted. This exposes APISIX management data to unauthorized parties. The flaw matters because the Admin API controls gateway configuration, so leaked management data can undermine the security of the whole deployment.

Impact

An attacker who reaches the Admin API with the default token gains read access to APISIX management data, as reflected by the high confidentiality impact in the CVSS vector. The record does not establish write access or direct code execution from this flaw alone.

Attack surface

The flaw is reachable over the network via the Admin API (AV:N) and requires low privileges (PR:L) with no user interaction (UI:N). It applies only when the Admin API is enabled and the access IP restriction rules have been deleted.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.72976 (99.4th percentile), and references include an exploit-tagged Packet Storm entry. The record does not confirm active exploitation in the wild.

What to do

• Upgrade Apache APISIX to a fixed release; the vendor advisory reference is tagged as a patch.
• Do not enable the Admin API unless it is strictly required.
• If the Admin API must be enabled, restore and enforce IP restriction rules so only trusted management hosts can reach it.
• Replace the default Admin API token with a strong unique value and rotate it.
• Restrict network access to the Admin API port using firewall or security group rules.

Detection

• Monitor Admin API access logs for requests using the default token or coming from unexpected source IPs.
• Alert on changes to Admin API IP restriction configuration or on deletion of those rules.
• Hunt for Admin API requests from hosts outside the expected management network.
• Review APISIX configuration for enabled Admin API with missing or empty IP allowlists.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.