Executive brief
Apache APISIX is a cloud-native API gateway used to manage and secure web traffic. A security flaw in its authentication plugin allows an attacker to bypass identity checks by spoofing headers. This could allow unauthorized users to impersonate legitimate accounts and gain access to protected internal services.
Technical details
An improper input validation vulnerability exists in the Apache APISIX 'forward-auth' plugin due to missing header cleanup. When specific configurations are used, the plugin fails to properly sanitize or strip incoming headers that are later used for identity verification. A remote attacker with low privileges can exploit this by injecting malicious identity headers into their requests, effectively spoofing their identity to downstream services. The issue affects versions 2.12.0 through 3.16.0 and is resolved in version 3.17.0 (or 3.16.1 as per some advisory notes).
Affected products
- Apache APISIX 2.12.0 through 3.16.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory