PT-2026-50879 · Apache · Apache Apisix

Fernando Mecozzi

·

CVE-2026-39998

·

Published

2026-06-19

·

Updated

2026-06-23

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.16.0
Description Improper Input Validation in the forward-auth plugin allows an attacker to spoof identity headers by leveraging specific configurations.
Recommendations Upgrade to version 3.17.0.

Exploit

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-08919
BIT-APISIX-2026-39998
CVE-2026-39998

Affected Products

Apache Apisix