{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31908", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-10T08:20:51.948Z", "datePublished": "2026-04-14T08:06:18.026Z", "dateUpdated": "2026-04-16T12:06:00.176Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.15.0", "status": "affected", "version": "2.12.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "SeungMyung Lee"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Header injection vulnerability in Apache APISIX.</p><span style=\"background-color: rgb(255, 255, 255);\">The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.</span><br><p>This issue affects Apache APISIX: from 2.12.0 through 3.15.0.</p><p>Users are recommended to upgrade to version 3.16.0, which fixes the issue.</p>"}], "value": "Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-75", "description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-14T08:06:18.026Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache APISIX: forward auth plugin allows header injection", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/14/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-14T08:37:15.159Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T11:42:56.365669Z", "id": "CVE-2026-31908", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:06:00.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/14/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-14T08:37:15.159Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-31908", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T11:42:56.365669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T11:42:47.278Z"}}], "cna": {"title": "Apache APISIX: forward auth plugin allows header injection", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "SeungMyung Lee"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache APISIX", "versions": [{"status": "affected", "version": "2.12.0", "versionType": "semver", "lessThanOrEqual": "3.15.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Header injection vulnerability in Apache APISIX.</p><span style=\"background-color: rgb(255, 255, 255);\">The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.</span><br><p>This issue affects Apache APISIX: from 2.12.0 through 3.15.0.</p><p>Users are recommended to upgrade to version 3.16.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-75", "description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-14T08:06:18.026Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31908", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:06:00.176Z", "dateReserved": "2026-03-10T08:20:51.948Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-14T08:06:18.026Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB303E55-AAEE-4906-9701-902E34BEDE2E", "versionEndExcluding": "3.16.0", "versionStartIncluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue."}], "id": "CVE-2026-31908", "lastModified": "2026-04-17T18:40:12.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-14T09:16:35.650", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/14/3"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-75"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0,3.15.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache APISIX", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apisix", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-17T08:27:39.270925+00:00", "value": {"mitigation_remediation": ["Upgrade Apache APISIX to version 3.16.0 or later", "Verify that the forward\u2011auth plugin is configured to reject untrusted or malformed header values", "Monitor gateway logs for anomalous header injection patterns"], "summary": {"action": "Patch Immediately", "impact": "HTTP Header Injection"}, "threat_synthesis": {"affected_systems": "Affected versions of Apache APISIX range from 2.12.0 through 3.15.0. The vulnerability is present in the forward\u2011auth plugin bundled with these releases, so any deployment utilizing that plugin for authentication forwarding is at risk.", "description_and_impact": "The forward\u2011auth plugin of Apache APISIX contains a header injection flaw. By altering the plugin\u2019s configuration, an attacker can insert arbitrary HTTP headers into requests forwarded to downstream services. This can allow alteration of request handling, bypass of authentication controls, or modification of responses, thereby potentially compromising the integrity and confidentiality of exchanges.", "risk_and_exploitability": "This CVE has a CVSS score of 9.1 and an EPSS score of less than 1%. It is not listed in the KEV catalog, so no publicly known exploits have been documented. The likely attack vector is remote via HTTP traffic to the gateway, as the flaw is triggered by requests that reach the forward\u2011auth plugin. Given the high severity score, the risk is considered high until an update is applied."}}}}, "created": "2026-04-14T16:15:49.153316+00:00", "updated": "2026-04-17T08:30:13.702645+00:00", "vendors": ["apache", "apache$PRODUCT$apisix"]}