CVE-2026-44087: Apache APISIX: Openid-connect plugin Identity Header Spoofing
Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.
The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44087?
CVE-2026-44087 has a medium severity rating of 5.3 on the CVSS scale.
How do I fix CVE-2026-44087?
To fix CVE-2026-44087, ensure that the openid-connect plugin is configured with sufficient verification checks for identity headers.
What systems are affected by CVE-2026-44087?
CVE-2026-44087 affects the Apache APISIX software when using the openid-connect plugin.
What kind of attack is possible with CVE-2026-44087?
CVE-2026-44087 allows attackers to spoof identity headers and gain unauthorized access to protected resources.
Is there a workaround for CVE-2026-44087 before applying a fix?
Currently, a recommended workaround for CVE-2026-44087 involves altering the plugin's configuration to enhance identity header verification.