# CVE-2022-24112: Apache APISIX - Authentication Bypass

> Live exploitation tracking for CVE-2022-24112 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-24112

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Apache APISIX
- **Weaknesses:** CWE-290 (Authentication Bypass by Spoofing)
- **Tags:** web_application

## Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

## CrowdSec analysis

[CVE-2022-24112](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-24112) is a critical vulnerability in Apache APISIX that allows attackers to exploit the batch-requests plugin to bypass IP restrictions on the Admin API, potentially leading to remote code execution when default configurations are used. This flaw enables unauthenticated attackers to circumvent security controls and gain unauthorized access, posing a significant risk of system compromise and data exposure.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2022-24112 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-24112 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-24112 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the `/apisix/batch-requests` endpoint to send crafted requests that abuse the batch-requests plugin, often including the `X-Real-IP: 127.0.0.1` header and targeting internal admin routes such as `/apisix/admin/routes/index` with a default or known API key to achieve remote code execution.

## Timeline

- 2022-02-11: CVE Published. CVE-2022-24112 is published to NVD.
- 2022-08-25: CISA KEV. CVE-2022-24112 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-09-15: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-04-08: Rule Released. CrowdSec releases a rule to detect CVE-2022-24112 exploitation attempts against the CrowdSec Network.
- 2026-04-09: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-24112 for the first time.

## References

- https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/02/11/3
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112
- http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24112.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-24112) follows observed exploitation activity for CVE-2022-24112. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.