CVE-2026-44087

CriticalCVSS 9.1/10Last modified Jun 23, 2026

Description

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.

The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2026
Last modified: Jun 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-440888.6SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads CVE-2026-440899.4Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability coul CVE-2026-44096.5The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and us CVE-2026-440909.8Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access b CVE-2026-440919.1An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the sy CVE-2026-440929.1An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fe CVE-2026-440937.8A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary CVE-2026-440948.6An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including defa CVE-2026-440957.8A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary comm CVE-2026-440967.8A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full syst CVE-2026-440977.1A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resu CVE-2026-440988.6This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command