What is the CVSS score of CVE-2026-31908?

CVE-2026-31908 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache APISIX are affected by CVE-2026-31908?

Apache APISIX versions 2.12.0 through 3.15.0 contain a critical header injection vulnerability in the forward-auth plugin that enables remote attackers to bypass authentication controls and escalate…

How to fix or mitigate CVE-2026-31908?

Within 24 hours: Identify all Apache APISIX deployments and document which versions (2.12.0-3.15.0) are running and whether the forward-auth plugin is enabled; if yes, immediately implement compensating controls including disabling client header relay and adding strict header validation. Within 7 days: Apply configuration hardening by disabling client header relay in forward-auth plugin settings or isolating the authentication service behind additional network controls; enable detailed audit logging of authentication requests and suspicious header patterns. Within 30 days: Plan and execute an upgrade to a patched version once released by Apache; evaluate whether forward-auth functionality can be temporarily disabled or replaced with alternative authentication mechanisms pending vendor patch availability.

Apache APISIX CVE-2026-31908

EUVD-2026-22225 CRITICAL

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)

2026-04-14 apache

GHSA-jv22-34xc-w9x6

Apache Code Injection Apache Apisix Apache Software Foundation

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation depends on a specific non-default forward-auth configuration; high confidentiality/integrity impact via auth bypass, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:43 vuln.today

CVSS changed

Apr 16, 2026 - 13:22 NVD

9.1 (CRITICAL)

EUVD ID Assigned

Apr 14, 2026 - 08:30 euvd

EUVD-2026-22225

CVE Published

Apr 14, 2026 - 08:06 nvd

CRITICAL 9.1

DescriptionCVE.org

Header injection vulnerability in Apache APISIX.

The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

AnalysisAI

Header injection in Apache APISIX 2.12.0 through 3.15.0 lets remote attackers smuggle attacker-controlled HTTP headers through the forward-auth plugin when it is configured to relay client headers to an external authentication service. Because injected headers can spoof identity or authorization data trusted by the upstream auth endpoint, this can lead to authentication bypass or privilege escalation. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but CISA's SSVC framework rates the technical impact as total and the attack as automatable.

Technical ContextAI

Apache APISIX is a CNCF cloud-native, dynamic API gateway built on OpenResty/NGINX and Lua. The affected component is the forward-auth plugin, which delegates request authorization by forwarding selected client request headers to an external authentication service and then honoring that service's response headers. The root cause maps to CWE-75 (failure to sanitize special elements into a different plane / special-element injection): the plugin does not adequately sanitize or isolate certain header values, so an attacker can inject or override headers that the upstream auth service or backend trusts. The single CPE provided (cpe:2.3:a:apache_software_foundation:apache_apisix) confirms the affected product is the core APISIX gateway rather than a downstream distribution or plugin package.

RemediationAI

Vendor-released patch: Apache APISIX 3.16.0 - upgrade to 3.16.0 or later, which fixes the header-sanitization issue in the forward-auth plugin. If immediate upgrade is not possible, the most direct compensating control is to disable the forward-auth plugin, or reconfigure it to stop forwarding attacker-controllable request headers to the upstream auth service (restrict the request_headers/allowed-headers list to a minimal known-safe set and do not blindly trust client-supplied auth headers); the trade-off is loss of the forward-auth authorization workflow or of specific header pass-through behavior. Additionally, harden the upstream authentication service to independently validate identity rather than trusting gateway-forwarded headers. Refer to the Apache advisory at https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b for authoritative guidance.