{"id":"CVE-2026-31908","aliases":["BIT-apisix-2026-31908","EUVD-2026-22225","GHSA-jv22-34xc-w9x6"],"status":"published","title":"Apache APISIX: forward auth plugin allows header injection","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00521,"percentile":0.44562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-75"],"published":"2026-04-14T08:06:18Z","modified":"2026-10-28T02:31:13Z","exploits":[{"source":"pocgithub","id":"MehranTurk/CVE-2026-31908","title":"MehranTurk/CVE-2026-31908","date":"2026-04-19","url":"https://github.com/MehranTurk/CVE-2026-31908"}],"fixes":[{"ecosystem":"Bitnami","package":"apisix","fixed_in":["3.16.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"apisix","ranges":[{"type":"SEMVER","events":[{"introduced":"2.12.0"},{"fixed":"3.16.0"}]}]}],"products":[{"vendor":"apache","product":"apisix"},{"vendor":"apache software foundation","product":"apache apisix"}],"references":[{"url":"https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/14/3","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31908","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jv22-34xc-w9x6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31908.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-31908","title":"Apache APISIX: forward auth plugin allows header injection","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","status":"published","published":"2026-04-14T08:06:18.026Z","modified":"2026-04-16T12:06:00.176Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-75"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-22225","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","status":"published","published":"2026-04-14T08:06:18Z","modified":"2026-04-16T12:06:00Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-jv22-34xc-w9x6","title":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain...","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","status":"published","published":"2026-04-14T09:30:45Z","modified":"2026-04-16T15:31:29Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-75"],"updated_at":"2026-11-02T15:07:31.233383Z"}],"nvd":[{"id":"CVE-2026-31908","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","status":"published","published":"2026-04-14T09:16:35.65Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-75"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-31908","title":"Apache APISIX: forward auth plugin allows header injection","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","status":"published","published":"2026-04-14T08:06:18.026Z","modified":"2026-10-28T02:31:13.215790624Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-75"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"BIT-apisix-2026-31908","title":"Apache APISIX: forward auth plugin allows header injection","description":"Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue.","status":"published","published":"2026-04-16T23:36:03.898Z","modified":"2026-09-08T08:45:32.630955292Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}