Header injection in Apache APISIX forward-auth plugin (CVE-2026-31908)

A header injection vulnerability exists in Apache APISIX's forward-auth plugin. An attacker can exploit certain plugin configurations to inject malicious headers, potentially enabling request forgery or privilege escalation against backend services. Affected versions: - Apache APISIX 2.12.0 through 3.15.0 We recommend updating to: 3.16.0. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b Details: https://vuln.today/cve/CVE-2026-31908