Apache Apisix vulnerabilities

CVE-2026-49231 [MEDIUM] CWE-290 CVE-2026-49231: Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed iden Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to

CVE-2026-44046 [MEDIUM] CWE-348 CVE-2026-44046: Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.

CVE-2025-46647 [MEDIUM] CWE-302 CVE-2025-46647: A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an imp A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the openid-connect plugin with introspection mode 2. The auth service connected to openid-connect provides services to multiple issuers 3. Multiple issuers share the same private key and relies onl

CVE-2026-44915 [MEDIUM] CWE-601 CVE-2026-44915: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default con URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2026-31924 [MEDIUM] CWE-319 CVE-2026-31924: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls l Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.