by Kastro
Paper/Archive/CVE-2026-44087

CVE-2026-44087

Apache Software Foundation Apache APISIX — Apache APISIX: Openid-connect plugin Identity Header Spoofing

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 20.7.207 × 204.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Affected

ProductAffectedFixed inSource
Apache APISIX2.3 – 3.16.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
apache (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread/72ryrgdssk6s2x9d6xn14bxyyl878xfmrefopenwall.com/lists/oss-security/2026/06/19/7