EUVD-2026-38017
GHSA-4v22-j8v6-qgvh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low privileges; scope changes to backend resources (S:C) with full confidentiality/integrity impact on downstream services but no availability or APISIX-local impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.
The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
AnalysisAI
Identity header spoofing in Apache APISIX's openid-connect plugin (versions 2.3 through 3.16.0) enables low-privileged network attackers to bypass authentication controls and gain unauthorized access to protected upstream resources. The plugin, under its default configuration, fails to strip or validate incoming identity-bearing HTTP headers presented by clients before forwarding requests to backend services, allowing an attacker to inject arbitrary identity claims. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, but the network-exploitable nature and high impact on subsequent systems (SC:H/SI:H in CVSS 4.0) elevate this beyond its moderate overall score.
Technical ContextAI
Apache APISIX is a high-performance cloud-native API gateway that uses a plugin architecture to enforce authentication and authorization policies. The openid-connect plugin integrates OIDC-based identity flows, typically adding identity-derived HTTP headers (such as consumer usernames or role claims) to requests forwarded to upstream services. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): the plugin, in its default configuration, does not sanitize or remove inbound request headers that mimic those it would itself generate, allowing a caller to pre-populate these headers with spoofed identity data. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* spanning versions 2.3 through 3.16.0. The CVSS 4.0 vector (SC:H/SI:H with VC:N/VI:N) is diagnostic: APISIX itself is not directly compromised, but the spoofed headers propagate to backend protected resources, producing high confidentiality and integrity impact on those downstream systems.
RemediationAI
The primary fix is to upgrade Apache APISIX to version 3.17.0 or later, which resolves the identity header spoofing issue in the openid-connect plugin, per the Apache advisory at https://lists.apache.org/thread/72ryrgdssk6s2x9d6xn14bxyyl878xfm. If immediate upgrade is not feasible, a targeted compensating control is to explicitly configure APISIX to strip or rewrite inbound identity headers (e.g., X-Consumer-Username, X-Consumer-Groups, or any header the openid-connect plugin sets) before they reach the plugin's processing stage, using APISIX's request-transformer plugin to remove untrusted client-supplied headers. This workaround requires careful enumeration of all header names the openid-connect plugin relies on and carries a risk of misconfiguration if headers are not exhaustively listed. Additionally, restricting network access to the APISIX gateway to known trusted clients reduces exposure, though this is a defense-in-depth measure rather than a fix.
More in Apache Apisix
View allHeader injection in Apache APISIX 2.12.0 through 3.15.0 lets remote attackers smuggle attacker-controlled HTTP headers t
Sensitive authentication tokens in Apache APISIX OpenID Connect plugin transmit in cleartext when connecting to identity
Authentication bypass in Apache APISIX versions 2.2 through 3.16.0 allows remote attackers to circumvent authentication
HMAC authentication replay in Apache APISIX 3.11.0 through 3.16.0 permits remote attackers who have captured a valid hma
Authentication bypass in Apache APISIX's jwe-decrypt plugin (versions 3.8.0 through 3.16.0) allows unauthenticated netwo
Identity header spoofing in Apache APISIX versions 2.12.0 through 3.16.0 allows a low-privileged network attacker to man
Authentication bypass in Apache APISIX 3.0.0 through 3.16.0 allows a network-accessible attacker holding valid credentia
Incorrect authorization in the Apache APISIX authz-casdoor plugin allows a network-authenticated attacker to cross-authe
Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent C
Identity header spoofing in the Apache APISIX OPA (Open Policy Agent) plugin allows low-privileged network attackers to
The wolf-rbac plugin in Apache APISIX 1.2.0 through 3.16.0 trusts client-controlled identity and IP data under its defau
Open redirect in Apache APISIX 3.0.0 through 3.16.0 enables unauthenticated remote attackers to manipulate specific HTTP
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today