Apache APISIX CVE-2026-44087

Q: What is the CVSS score of CVE-2026-44087?

CVE-2026-44087 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38017 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-06-19 apache

GHSA-4v22-j8v6-qgvh

Authentication Bypass Apache Apache Apisix Apache Software Foundation

5.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-exploitable with low privileges; scope changes to backend resources (S:C) with full confidentiality/integrity impact on downstream services but no availability or APISIX-local impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:23 vuln.today

CVE Published

Jun 19, 2026 - 13:11 cve.org

MEDIUM 5.3

DescriptionCVE.org

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.

The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

Identity header spoofing in Apache APISIX's openid-connect plugin (versions 2.3 through 3.16.0) enables low-privileged network attackers to bypass authentication controls and gain unauthorized access to protected upstream resources. The plugin, under its default configuration, fails to strip or validate incoming identity-bearing HTTP headers presented by clients before forwarding requests to backend services, allowing an attacker to inject arbitrary identity claims. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, but the network-exploitable nature and high impact on subsequent systems (SC:H/SI:H in CVSS 4.0) elevate this beyond its moderate overall score.

Technical ContextAI

Apache APISIX is a high-performance cloud-native API gateway that uses a plugin architecture to enforce authentication and authorization policies. The openid-connect plugin integrates OIDC-based identity flows, typically adding identity-derived HTTP headers (such as consumer usernames or role claims) to requests forwarded to upstream services. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): the plugin, in its default configuration, does not sanitize or remove inbound request headers that mimic those it would itself generate, allowing a caller to pre-populate these headers with spoofed identity data. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* spanning versions 2.3 through 3.16.0. The CVSS 4.0 vector (SC:H/SI:H with VC:N/VI:N) is diagnostic: APISIX itself is not directly compromised, but the spoofed headers propagate to backend protected resources, producing high confidentiality and integrity impact on those downstream systems.

RemediationAI

The primary fix is to upgrade Apache APISIX to version 3.17.0 or later, which resolves the identity header spoofing issue in the openid-connect plugin, per the Apache advisory at https://lists.apache.org/thread/72ryrgdssk6s2x9d6xn14bxyyl878xfm. If immediate upgrade is not feasible, a targeted compensating control is to explicitly configure APISIX to strip or rewrite inbound identity headers (e.g., X-Consumer-Username, X-Consumer-Groups, or any header the openid-connect plugin sets) before they reach the plugin's processing stage, using APISIX's request-transformer plugin to remove untrusted client-supplied headers. This workaround requires careful enumeration of all header names the openid-connect plugin relies on and carries a risk of misconfiguration if headers are not exhaustively listed. Additionally, restricting network access to the APISIX gateway to known trusted clients reduces exposure, though this is a defense-in-depth measure rather than a fix.