CVE-2026-44087

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44087
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44087.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44087
Aliases
Downstream
Published
2026-06-19T13:11:17.219Z
Modified
2026-07-08T08:09:36.422415737Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Apache APISIX: Openid-connect plugin Identity Header Spoofing
Details

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.

The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.3"
                },
                {
                    "last_affected": "3.16.0"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "2.3"
                },
                {
                    "fixed": "3.16.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44087.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-345"
    ]
}
References

Affected packages

Git / github.com/apache/apisix

Affected ranges

Type
GIT
Repo
https://github.com/apache/apisix
Events
Introduced
63f779aeae7a4cfdc3baa5c6dad955ef139719f8
Fixed
9ef2ecab67f652d38365049613610ef649bb4ad0
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.3"
        },
        {
            "fixed": "3.17.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44087.json"