CVE-2025-62232

High

Description

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Apache Apisix

PublishedOct 31, 2025

First seenOct 31, 2025

Weakness typeCWE-532CWE-532

How to fix

Update

apache apisix3.14.0 or later

Vendor advisories

lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259

Affected products

Product	Affected versions	Fixed in
apache apisix	1.0 ≤ v < 3.14.0	3.14.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.