Apache APISIX is vulnerable to the exposure of plaintext credentials in logs, posing a significant risk of unauthorized access to sensitive systems.

This vulnerability is classified as an insertion of sensitive information into a log file (CWE-532), where unauthenticated access to system logs allows for the harvesting of plaintext usernames and passwords.

The exposure of credentials in log files creates a severe risk of unauthorized access and privilege escalation across the infrastructure. With a CVSS score of 7.5, this high-severity flaw enables attackers with access to log management systems to compromise user accounts, leading to potential data breaches, unauthorized system modifications, and long-term persistence in the environment.

Immediate Action: Upgrade Apache APISIX to version 3.14 or later to implement the vendor-provided fix.

Proactive Monitoring: Review existing logging configurations to ensure that sensitive data is not being captured and inspect log management systems for unauthorized access or suspicious querying patterns.

Compensating Controls: Restrict access to log files and log management servers to authorized personnel only, and implement temporary log masking or redaction rules for authentication-related fields.

Public Exploit Available: No (exploit_available: false)

Given the potential for wholesale credential exposure, organizations should prioritize upgrading to version 3.14 immediately. If an immediate upgrade is not feasible, restrict access to log files and audit logs to identify any potential exposure of credentials that may have already occurred.