CVE-2026-39998
published 2026-06-19CVE-2026-39998: Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity…
PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.40%
32.9th percentile
Improper Input Validation vulnerability in Apache APISIX.
The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers.
This issue affects Apache APISIX: from 2.12.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apisix | >= 2.12.0 < 3.17.0 | 3.17.0 |
| apache_software_foundation | apache_apisix | 2.12.0 – 3.16.0 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache APISIX up to 3.16.0 Configuration input validation (EUVD-2026-38011)
vuldb·2026-06-19
CVE-2026-39998 [CRITICAL] Apache APISIX up to 3.16.0 Configuration input validation (EUVD-2026-38011)
A vulnerability was found in Apache APISIX up to 3.16.0. It has been rated as critical. This issue affects some unknown processing of the component Configuration Handler. The manipulation leads to improper input validation.
This vulnerability is referenced as CVE-2026-39998. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
GHSA
Improper Input Validation vulnerability in Apache APISIX.
ghsa_unreviewed·2026-06-19
CVE-2026-39998 [MEDIUM] CWE-20 Improper Input Validation vulnerability in Apache APISIX.
Improper Input Validation vulnerability in Apache APISIX.
The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers.
This issue affects Apache APISIX: from 2.12.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-19
Published