{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31908", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-10T08:20:51.948Z", "datePublished": "2026-04-14T08:06:18.026Z", "dateUpdated": "2026-04-14T08:37:15.159Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.15.0", "status": "affected", "version": "2.12.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "SeungMyung Lee"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Header injection vulnerability in Apache APISIX.</p><span style=\"background-color: rgb(255, 255, 255);\">The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.</span><br><p>This issue affects Apache APISIX: from 2.12.0 through 3.15.0.</p><p>Users are recommended to upgrade to version 3.16.0, which fixes the issue.</p>"}], "value": "Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-75", "description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-14T08:06:18.026Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache APISIX: forward auth plugin allows header injection", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/14/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-14T08:37:15.159Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Header injection vulnerability in Apache APISIX.\n\nThe attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.\nThis issue affects Apache APISIX: from 2.12.0 through 3.15.0.\n\nUsers are recommended to upgrade to version 3.16.0, which fixes the issue."}], "id": "CVE-2026-31908", "lastModified": "2026-04-14T09:16:35.650", "metrics": {}, "published": "2026-04-14T09:16:35.650", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/04/14/3"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-75"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0,3.15.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache APISIX", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apisix", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-14T10:22:53.160585+00:00", "value": {"mitigation_remediation": ["Upgrade Apache APISIX to version 3.16.0 or later", "Verify that the forward\u2011auth plugin is configured to reject untrusted or malformed header values", "Monitor gateway logs for anomalous header injection patterns"], "summary": {"action": "Patch Immediately", "impact": "HTTP Header Injection"}, "threat_synthesis": {"affected_systems": "Affected versions of Apache APISIX range from 2.12.0 through 3.15.0. The vulnerability is present in the forward\u2011auth plugin bundled with these releases, so any deployment utilizing that plugin for authentication forwarding is at risk.", "description_and_impact": "The forward\u2011auth plugin of Apache APISIX contains a header injection flaw. By altering the plugin\u2019s configuration, an attacker can insert arbitrary HTTP headers into requests forwarded to downstream services. This can allow alteration of request handling, bypass of authentication controls, or modification of responses, thereby potentially compromising the integrity and confidentiality of exchanges.", "risk_and_exploitability": "The CVE does not report a CVSS score or EPSS data, and it is not listed in the KEV catalog, so no official severity or known exploits are recorded. The typical attack vector is inferred to be remote via HTTP traffic to the gateway, as the flaw is triggered by requests that reach the forward\u2011auth plugin. Given the lack of an in\u2011range patch and the ease of triggering the injection, the risk is likely moderate to high until an update is applied."}}}}, "created": "2026-04-14T16:15:49.153316+00:00", "updated": "2026-04-14T16:30:45.922326+00:00", "vendors": ["apache", "apache$PRODUCT$apisix"]}