CVE-2026-44087: Apache APISIX Auth Bypass Vulnerability

CVE-2026-44087 Overview

CVE-2026-44087 is an Insufficient Verification of Data Authenticity vulnerability [CWE-345] in Apache APISIX. The flaw resides in the openid-connect plugin running under its default configuration. Attackers can spoof identity headers on inbound requests and bypass authentication enforced by the gateway. Successful exploitation grants unauthorized access to protected upstream resources.

The issue affects Apache APISIX versions 2.3 through 3.16.0. The Apache APISIX project recommends upgrading to version 3.17.0, which fixes the issue.

Critical Impact
Authenticated attackers with low privileges can spoof identity headers to gain unauthorized access to protected resources behind the API gateway.

Affected Products

Apache APISIX 2.3 through 3.16.0
Deployments using the openid-connect plugin with default configuration
API gateways relying on openid-connect for upstream authorization

Discovery Timeline

2026-06-19 - CVE-2026-44087 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-44087

Vulnerability Analysis

Apache APISIX is a cloud-native API gateway that routes requests to upstream services. The openid-connect plugin integrates the gateway with OpenID Connect (OIDC) identity providers. Under the default configuration, the plugin attaches identity claims to upstream requests using HTTP headers such as X-Userinfo, X-Access-Token, and X-ID-Token.

The vulnerability stems from the plugin not stripping these identity headers when they are supplied by the client. A remote attacker can craft a request that injects forged identity headers. The gateway forwards the spoofed values to the upstream service. Upstream applications that trust these headers as proof of authentication then treat the attacker as an authenticated principal.

Root Cause

The root cause is insufficient verification of data authenticity [CWE-345]. The plugin does not distinguish between identity headers generated by APISIX after successful OIDC validation and identity headers supplied by an untrusted client. Default plugin behavior leaves the client-controlled values intact, so the upstream cannot tell whether the gateway authenticated the request.

Attack Vector

The attack is network-based and requires no user interaction. An attacker sends an HTTP request directly to an APISIX route protected by the openid-connect plugin and includes forged identity headers naming a privileged user. Because the gateway preserves these headers when relaying the request, the upstream service receives a payload that appears to originate from an authenticated session. The attacker bypasses authentication and accesses protected functionality.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the Apache Security Mailing List advisory and the Openwall OSS Security post.

Detection Methods for CVE-2026-44087

Indicators of Compromise

Inbound HTTP requests containing X-Userinfo, X-Access-Token, or X-ID-Token headers originating from clients outside the trusted identity provider.
Access logs showing successful requests to OIDC-protected routes without a corresponding token exchange or authorization code flow.
Upstream application logs recording authenticated actions for user identifiers that have no matching APISIX OIDC session entries.

Detection Strategies

Compare APISIX access.log entries against OIDC identity provider logs to find authenticated upstream calls that lack a matching IdP authentication event.
Inspect HTTP request streams at the edge for client-supplied identity headers that should only be generated by the gateway.
Hunt for anomalous user identifier values in upstream audit logs that correlate with requests served by APISIX routes using openid-connect.

Monitoring Recommendations

Enable verbose logging for the openid-connect plugin and forward logs to a centralized analytics platform.
Alert on any client request that arrives with identity headers reserved for gateway-to-upstream communication.
Monitor APISIX version inventory and flag instances running 2.3 through 3.16.0 for prioritized patching.

How to Mitigate CVE-2026-44087

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0 or later on all gateway nodes.
Audit every route that enables the openid-connect plugin and review its configuration against the fixed defaults.
Rotate any credentials or sessions that may have been exposed through forged identity headers before the upgrade.

Patch Information

Apache APISIX 3.17.0 addresses CVE-2026-44087. Refer to the Apache Security Mailing List advisory for upgrade guidance and release notes. The patch corrects the plugin's handling of identity headers so that client-supplied values cannot impersonate gateway-issued identity claims.

Workarounds

Configure APISIX to explicitly remove X-Userinfo, X-Access-Token, and X-ID-Token headers from incoming client requests before the openid-connect plugin executes.
Place a trusted reverse proxy or WAF in front of APISIX that strips identity headers from untrusted sources.
Require upstream services to validate JWTs directly instead of trusting gateway-injected identity headers until the upgrade is complete.

bash

# Example APISIX route snippet: strip client-supplied identity headers
# Apply via the proxy-rewrite plugin before openid-connect runs
plugins:
  proxy-rewrite:
    headers:
      remove:
        - X-Userinfo
        - X-Access-Token
        - X-ID-Token
  openid-connect:
    client_id: "your-client-id"
    discovery: "https://idp.example.com/.well-known/openid-configuration"
    bearer_only: true