Executive brief
Apache APISIX is a cloud-native API gateway used to manage and secure traffic between users and backend services. A vulnerability in its Open Policy Agent (OPA) plugin allows attackers to send fake identity information to backend systems if the plugin is used with a specific non-default configuration. This could allow an unauthorized user to gain higher privileges or access sensitive data by pretending to be a different user.
Technical details
An authentication bypass by spoofing (CWE-290) exists in the Apache APISIX 'opa' plugin. When configured in a specific non-default manner, the plugin fails to properly validate or sanitize identity headers before relaying them to upstream services. A remote attacker with low privileges can exploit this by injecting spoofed identity headers into their requests, leading the upstream service to grant unauthorized access or elevated privileges. The vulnerability affects versions 3.5.0 through 3.16.0 and is resolved in version 3.17.0.
Affected products
- Apache APISIX 3.5.0 through 3.16.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 3.17.0