CVE-2026-48895: Apache APISIX Open Redirect Vulnerability

CVE-2026-48895 Overview

CVE-2026-48895 is an open redirect vulnerability [CWE-601] affecting Apache APISIX, an open-source API gateway. Attackers can manipulate specific client headers to trigger redirection to an untrusted site, which can expose the session token of the redirected user. The flaw affects Apache APISIX versions 3.0.0 through 3.16.0. The Apache APISIX project has released version 3.17.0 to remediate the issue.

Critical Impact
Manipulating client-supplied headers allows attackers to redirect users to attacker-controlled destinations and potentially leak session tokens used to authenticate against APISIX-fronted services.

Affected Products

Apache APISIX 3.0.0 through 3.16.0
Deployments using APISIX as an API gateway in front of upstream services
Environments relying on APISIX for session-bearing client traffic

Discovery Timeline

2026-06-19 - CVE-2026-48895 published to NVD
2026-06-19 - Apache Security Announcement published via Apache mailing list
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48895

Vulnerability Analysis

The vulnerability is classified as URL Redirection to Untrusted Site, commonly known as an open redirect [CWE-601]. Apache APISIX processes certain client-controllable HTTP headers when constructing redirect responses. An attacker who controls the value of these headers can direct the gateway to issue an HTTP redirect pointing to an attacker-chosen host.

Because the redirect originates from the trusted APISIX endpoint, users and downstream applications may trust the destination URL. If session tokens are transmitted in URL parameters, the Referer header, or other contextual data during the redirect, the attacker-controlled site can capture them. The issue is exploitable over the network and requires the victim to interact with a crafted request or link.

Root Cause

The root cause is improper validation of redirect destinations derived from client-supplied header values. APISIX uses these headers in redirect logic without sufficiently constraining the target host against an allowlist of trusted origins. This permits arbitrary external URLs to appear as the redirect target.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically by clicking a crafted link or visiting a page that issues a request through the APISIX gateway. The attacker crafts the request with manipulated header values that influence redirect generation. When APISIX returns the redirect response, the victim's browser follows the URL to the attacker's domain, where session tokens or other contextual information can be harvested.

No public proof-of-concept code has been published. See the Apache Security Announcement and the Openwall OSS-Security update for vendor-provided technical details.

Detection Methods for CVE-2026-48895

Indicators of Compromise

HTTP 3xx redirect responses from APISIX pointing to external hosts not listed in your trusted-domain allowlist.
Inbound requests containing unusual or attacker-controllable values in headers used by APISIX redirect logic (for example, X-Forwarded-Host, Host, or Referer).
Outbound traffic from end-user browsers to unfamiliar domains immediately after authenticating against an APISIX-fronted service.

Detection Strategies

Inspect APISIX access logs for Location headers in responses that resolve to domains outside your organization's trusted list.
Correlate redirect responses with the originating request headers to identify header manipulation attempts.
Hunt for phishing-style URLs whose path begins with a legitimate APISIX-fronted hostname but whose redirect target points elsewhere.

Monitoring Recommendations

Forward APISIX access and error logs to a centralized analytics platform for query and correlation.
Alert on redirect responses where the destination host does not match a curated allowlist of internal and partner domains.
Monitor authentication services for anomalous session reuse from new geolocations following a redirect event.

How to Mitigate CVE-2026-48895

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0 or later, which contains the official fix.
Inventory all APISIX deployments and confirm the running version against the affected range 3.0.0 through 3.16.0.
Rotate session tokens and credentials for any user accounts suspected of having traversed a manipulated redirect.

Patch Information

The Apache APISIX project resolved this issue in version 3.17.0. Patch details are published in the Apache Security Announcement and mirrored in the Openwall OSS-Security advisory. Operators should plan an upgrade window and validate the gateway configuration post-upgrade.

Workarounds

Place a reverse proxy or web application firewall in front of APISIX to strip or normalize client-supplied headers such as X-Forwarded-Host before they reach the gateway.
Configure upstream applications to ignore redirect-influencing headers when the source IP is not a trusted load balancer.
Restrict outbound redirects through APISIX route configuration to a strict allowlist of internal hostnames until the upgrade is complete.

bash

# Configuration example: verify the installed Apache APISIX version
apisix version

# Upgrade using the official Helm chart (example)
helm repo update
helm upgrade apisix apisix/apisix --version <chart-version-shipping-3.17.0>