Vulnerability record · CVE-2021-45232 · published 27 December 2021
CVE-2021-45232: Apache APISIX Dashboard authentication bypass in Manager API
Apache · Apisix Dashboard
Apache APISIX Dashboard before 2.10.1 mixes two web frameworks: APIs and authentication middleware are built on droplet, but some API endpoints use gin interfaces directly, skipping the authentication middleware. This lets unauthenticated requests reach critical Manager API functions, which matters because the dashboard controls gateway configuration.
Description
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this an urgent pre-auth bypass on an internet-reachable management interface.
What it is
Apache APISIX Dashboard before 2.10.1 mixes two web frameworks: APIs and authentication middleware are built on droplet, but some API endpoints use gin interfaces directly, skipping the authentication middleware. This lets unauthenticated requests reach critical Manager API functions, which matters because the dashboard controls gateway configuration.
Impact
An unauthenticated attacker can invoke protected Manager API endpoints, gaining full read and write control over the dashboard's configuration data. Given the CVSS scope, this can lead to complete compromise of confidentiality, integrity and availability of the affected component.
Attack surface
Reachable over the network via the Manager API HTTP interface; the CVSS vector shows no privileges and no user interaction required. Any deployment exposing the dashboard Manager API to untrusted networks is at risk.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.859, 99.7th percentile), indicating strong likelihood of attempted exploitation.
What to do
- Upgrade Apache APISIX Dashboard to 2.10.1 or later, which fixes the authentication bypass.
- If immediate upgrade is not possible, restrict network access to the Manager API to trusted management hosts only.
- Place the dashboard behind an authenticating reverse proxy or VPN rather than exposing it directly.
- Audit dashboard configuration and logs for unauthorized changes made through Manager API endpoints.
Detection
- Monitor Manager API access logs for requests to endpoints that should require authentication but arrive without a valid session or token.
- Alert on configuration changes or API calls originating from unexpected source IPs or user agents.
- Compare dashboard configuration against known-good baselines to spot unauthorized modifications.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2021/12/27/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5 | Mailing ListVendor Advisory |
| http://www.openwall.com/lists/oss-security/2021/12/27/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5 | Mailing ListVendor Advisory |
Track CVE-2021-45232 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-45232), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
