CVE-2026-49231

Analyzed Analyzed - Analysis Complete

Authentication Bypass via Spoofed Headers in Apache APISIX

Publication date: 2026-06-19

Last updated on: 2026-06-23

Assigner: Apache Software Foundation

Description

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-23

Generated

2026-07-10

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-08

NVD

CVE-2026-49231

EUVD

EUVD-2026-38020

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apisix	From 3.5.0 (inc) to 3.17.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

CVE-2026-49231 is an authentication bypass vulnerability in the opa plugin of Apache APISIX, affecting versions 3.5.0 through 3.16.0.

An attacker can exploit this vulnerability by spoofing identity headers and relaying them to upstream services due to a non-default configuration in the opa plugin.

This allows the attacker to assume higher privileges on the upstream service, effectively bypassing authentication controls.

Impact Analysis

This vulnerability can allow an attacker to gain elevated privileges on upstream services by spoofing identity headers.

As a result, unauthorized users could access or manipulate resources they should not have permission to, potentially leading to data breaches or service disruptions.

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade Apache APISIX to version 3.17.0 or later, which contains the fix for this authentication bypass issue.

Compliance Impact

This vulnerability allows an attacker to bypass authentication by spoofing identity headers, potentially gaining higher privileges on upstream services.

Such unauthorized privilege escalation could lead to unauthorized access to sensitive data or systems, which may impact compliance with standards and regulations like GDPR or HIPAA that require strict access controls and protection of personal or sensitive information.

However, the provided information does not explicitly describe the direct impact on compliance with these standards.

Hi! I’m here to help you understand CVE-2026-49231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70