Is CVE-2026-44046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44046 being exploited in the wild.

How severe is CVE-2026-44046?

Informational severity, with a CVSS score of 2.3, published 19 June 2026.

Which products and versions are affected?

Apache APISIX 1.2.0 through 3.16.0.

Is there a fix for CVE-2026-44046?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44046 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44046?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44046: Apache APISIX identity spoofing in wolf-rbac plugin

CVE-2026-44046 · Severity: info · CVSS 2.3 · Published 2026-06-19

Apache APISIX, a popular cloud-native API gateway, contains a security flaw in its wolf-rbac plugin. Under default configurations, an attacker can bypass certain IP-based access controls and inject false identity information into system logs. This could allow unauthorized access to protected resources or hinder forensic investigations by masking the attacker's true identity.

Quick answers

Is CVE-2026-44046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44046 being exploited in the wild.
How severe is CVE-2026-44046?: Informational severity, with a CVSS score of 2.3, published 19 June 2026.
Which products and versions are affected?: Apache APISIX 1.2.0 through 3.16.0.
Is there a fix for CVE-2026-44046?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44046 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44046?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'Use of Less Trusted Source' (CWE-348) vulnerability exists in the Apache APISIX wolf-rbac plugin. In default configurations, the plugin fails to properly validate or prioritize trusted sources for identity and IP information. A remote attacker with low privileges can exploit this to spoof identity data, leading to log pollution and the potential bypass of IP-based access control lists (ACLs). The vulnerability affects versions 1.2.0 through 3.16.0 and is resolved in version 3.17.0 (or 3.16.1 as noted in some advisory channels).

Affected products

Apache APISIX 1.2.0 through 3.16.0

Timeline

2026-06-19: disclosed
2026-06-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.