Apache APISIX EUVD-2026-38020

Q: What is the CVSS score of EUVD-2026-38020?

EUVD-2026-38020 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-49231 LOW

Authentication Bypass by Spoofing (CWE-290)

2026-06-19 apache

GHSA-3cm7-pvjf-2x7q

Authentication Bypass Apache Apache Apisix Apache Software Foundation

2.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Non-default configuration prerequisite (AT:P in 4.0) maps to AC:H; low privileges required; only subsequent-system confidentiality and integrity are affected at low severity.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:24 vuln.today

DescriptionCVE.org

Authentication Bypass by Spoofing vulnerability in opa plugin.

An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin.

This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

Identity header spoofing in the Apache APISIX OPA (Open Policy Agent) plugin allows low-privileged network attackers to relay forged identity headers to upstream services, potentially assuming elevated privileges on those services. Versions 3.5.0 through 3.16.0 are affected, but only when the OPA plugin is deployed in a non-default configuration that fails to sanitize inbound identity headers before forwarding them. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 2.3 reflects the constrained real-world impact driven by the specific configuration prerequisite and the limitation that only downstream upstream services are affected rather than APISIX itself.

Technical ContextAI

Apache APISIX is a high-performance, cloud-native API gateway. Its OPA plugin integrates with the Open Policy Agent to enforce policy-based authorization decisions at the gateway layer. CWE-290 (Authentication Bypass by Spoofing) describes vulnerabilities where an attacker manipulates identity assertions - in this case, HTTP identity headers that APISIX forwards to upstream services. Under a non-default OPA plugin configuration, APISIX does not properly strip or validate these headers before relay, enabling a caller to inject arbitrary identity claims that the upstream service then acts upon. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_apisix covering versions 3.5.0 through 3.16.0. The CVSS 4.0 AT:P (Attack Target Present) metric formally encodes the non-default configuration dependency as a specific exploitation prerequisite.

RemediationAI

Upgrade Apache APISIX to version 3.17.0, which resolves the issue per the vendor advisory at https://lists.apache.org/thread/s1jd1vxm59p6ghx47xhmpjdk1cobo4hn. If an immediate upgrade is not feasible, administrators should audit the OPA plugin configuration and restore default settings for identity header handling, removing any non-default configuration that permits forwarding of inbound identity headers without sanitization - this eliminates the spoofing vector without disabling the plugin entirely. As an alternative compensating control, disabling the OPA plugin until the upgrade is applied is viable but carries the trade-off of removing policy-based authorization enforcement, which may require a fallback authorization mechanism to maintain security posture.