Apache APISIX CVE-2026-44046

Q: What is the CVSS score of CVE-2026-44046?

CVE-2026-44046 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38014 LOW

Use of Less Trusted Source (CWE-348)

2026-06-19 apache

GHSA-pmhp-pr8x-258q

Apache Information Disclosure Apache Apisix Apache Software Foundation

2.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Network vector with PR:L because low-privilege access is required; AC:H reflects the specific wolf-rbac plugin configuration prerequisite; S:C captures downstream log and IP ACL integrity impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:21 vuln.today

DescriptionCVE.org

Use of Less Trusted Source vulnerability in Apache APISIX.

Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

The wolf-rbac plugin in Apache APISIX 1.2.0 through 3.16.0 trusts client-controlled identity and IP data under its default configuration, allowing a low-privileged network attacker to inject spoofed identity information into application logs and manipulate IP-based access control rule evaluation. Rooted in CWE-348 (Use of Less-Trusted Source), the plugin accepts identity claims from a less-trusted input channel rather than authoritative internal state. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; the vendor has released a fix in version 3.17.0.

Technical ContextAI

CWE-348 (Use of Less-Trusted Source) describes a design flaw where software relies on data from a lower-trust source when a higher-trust source is available or required. Apache APISIX is a cloud-native API gateway; its wolf-rbac plugin integrates with the Wolf authorization service to provide Role-Based Access Control (RBAC) across API routes. Under default configuration, the plugin uses client-influenced request attributes - such as headers or request metadata - to resolve the requestor's identity and IP address, rather than deriving these from internally verified, server-side sources. This makes it possible for a client to present falsified identity or IP information that the plugin processes as authoritative. The CPE string cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* covers all versions from 1.2.0 through 3.16.0 of the Apache Software Foundation's APISIX project. The vulnerability is not in the Wolf RBAC service itself but in how APISIX's wolf-rbac plugin handles and trusts the source of the identity and IP data it forwards.

RemediationAI

Vendor-released patch: Apache APISIX 3.17.0, as documented in the Apache Software Foundation advisory at https://lists.apache.org/thread/xkshmps51b24yw0qckl5h5ddyv0x6qf9. Organizations should prioritize upgrading to 3.17.0. For deployments unable to upgrade immediately, disabling the wolf-rbac plugin entirely removes the attack surface; however, this eliminates all RBAC enforcement provided by that plugin and requires an alternative authorization mechanism. If IP-based access control is a critical security boundary, supplement or replace it with controls that operate outside APISIX's trust boundary - for example, network-layer IP enforcement via a load balancer, WAF, or mTLS mutual authentication, which cannot be spoofed through application-layer header manipulation. Deploying centralized log integrity monitoring (e.g., log signing or shipping to a write-once SIEM) can limit the impact of log pollution and detect anomalous identity values in wolf-rbac entries during the pre-patch window.