Apache APISIX CVE-2026-39998

Q: What is the CVSS score of CVE-2026-39998?

CVE-2026-39998 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38011 MEDIUM

Improper Input Validation (CWE-20)

2026-06-19 apache

GHSA-86hq-f9pp-3cr9

Apache Information Disclosure Apache Apisix Apache Software Foundation

5.8

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Specific forward-auth plugin configuration required maps to AC:H; impact is on backend systems not APISIX itself (S:C); no availability impact confirmed by description.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:21 vuln.today

CVE Published

Jun 19, 2026 - 13:04 cve.org

MEDIUM 5.8

DescriptionCVE.org

Improper Input Validation vulnerability in Apache APISIX.

The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

Identity header spoofing in Apache APISIX versions 2.12.0 through 3.16.0 allows a low-privileged network attacker to manipulate header values forwarded by the forward-auth plugin to upstream backend services. The flaw, rooted in improper input validation (CWE-20) of the forward-auth plugin's header handling, enables an attacker to impersonate other identities as seen by backend services that rely on APISIX to assert trustworthy identity context. No active exploitation is confirmed in CISA KEV and no public proof-of-concept has been identified, but the CVSS 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H) signal that backend services face high-severity consequences if exploited.

Technical ContextAI

Apache APISIX is an open-source, high-performance API gateway that proxies HTTP traffic and applies plugins - including authentication delegation - at the route level. The forward-auth plugin works by forwarding incoming client requests to an external authorization service; headers returned by that service (typically identity assertions such as X-User-ID or X-Forwarded-User) are then relayed to upstream backends, which treat them as authoritative identity claims. CWE-20 (Improper Input Validation) identifies the root cause: APISIX fails to adequately sanitize or validate these header values under certain plugin configurations, permitting an attacker to inject or override identity-bearing headers before they reach backends. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* spanning versions 2.12.0 through 3.16.0. Critically, the CVSS 4.0 vector records zero impact on the vulnerable APISIX system itself (VC:N/VI:N/VA:N) while registering maximum subsequent-system impact (SC:H/SI:H/SA:H), which is architecturally consistent with a gateway-level flaw whose damage is realized in the trusting backends rather than the gateway itself.

RemediationAI

Upgrade Apache APISIX to version 3.17.0, the vendor-confirmed fix release, as documented in the Apache security advisory at https://lists.apache.org/thread/vgkvy396010d7g6m0jrn4d3hjf2svlvw. If immediate upgrade is not possible, the most effective compensating control is to disable the forward-auth plugin on all routes until patching is complete - note this removes external auth delegation and requires a fallback authentication mechanism. A narrower alternative is to configure the forward-auth plugin to forward only an explicit allowlist of headers to upstream services rather than relaying arbitrary auth-service headers, which reduces the spoofable header surface while preserving plugin functionality; however, the specific configuration that triggers the vulnerability is not fully enumerated in available data, so consult the advisory before relying on this as a complete mitigation. Additionally, backend services should be reviewed to confirm they do not unconditionally trust identity headers without independent validation, providing defense-in-depth regardless of patch timing.