CVE-2026-44087: Apache APISIX openid-connect Plugin Identity Header Spoofing

Overview

The record describes an insufficient verification of data authenticity issue (CWE-345) in the openid-connect plugin of Apache APISIX under default configuration. The attack surface allows identity headers to be spoofed, which can lead to unauthorized access to protected resources. The vendor advisory is available on the Apache mailing list and is also mirrored by oss-security.

Impact

• The record states that an attacker may obtain unauthorized access to protected resources.
• NVD assigns a CVSS 3.1 base score of 9.1 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network reachability, low complexity, no privileges or user interaction required, and high confidentiality and integrity impact.
• The CNA (security@apache.org) lists a CVSS 4.0 score of 5.3.

Affected products and versions

• Product: Apache APISIX.
• The affected range in the record is written as "≥ 2.3 and < 3.17.0", and the description states that the issue affects versions from 2.3 through 3.16.0.
• The description recommends upgrading to version 3.17.0, which fixes the issue.
• The record's fixes list is empty, so the fixed version is taken from the description text only.

Exploitation status

• The record shows the CISA KEV flag as not listed.
• No confirmed exploitation appears in the sources consulted for this analysis.
• No EPSS score is available in the record.

Remediation and mitigation

• Upgrade Apache APISIX to version 3.17.0 or later, as recommended in the description.
• Until the upgrade is applied, review whether the openid-connect plugin is enabled on routes that protect sensitive resources, and confirm how identity headers are set, overwritten or stripped at the gateway before requests reach upstream services.
• Reduce exposure of protected routes to untrusted networks where operationally feasible.

Detection guidance

• Review gateway and upstream access logs for requests to protected routes that carry identity headers not produced by the expected authentication flow.
• Correlate successful access to protected resources with authentication events to identify requests that lack a matching authenticated session.
• Treat unexplained access to sensitive resources as a potential incident and follow your internal response process.

Limitations of the available information

• The record does not identify the specific header names, plugin configuration conditions or request characteristics involved.
• The fixes list in the record is empty; the fixed version comes from the description.
• The record title is null; the titles in this analysis are derived from the description and CWE.
• The vendor advisory content beyond the record's description was not retrieved for this analysis.
• The record does not provide EPSS or SSVC data.

Frequently asked questions

What is the core issue in CVE-2026-44087?

The record describes an insufficient verification of data authenticity (CWE-345) in the openid-connect plugin of Apache APISIX under default configuration, which allows identity headers to be spoofed.

Which Apache APISIX versions are affected?

The description states that versions from 2.3 through 3.16.0 are affected, and the record's affected range is 2.3 up to but not including 3.17.0.

What is the recommended fix?

The description recommends upgrading to version 3.17.0, which fixes the issue. The record's fixes list is empty, so this comes from the description text.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.