CVE-2026-49231

MediumCVSS 5.4/10Last modified Jun 23, 2026

Description

Authentication Bypass by Spoofing vulnerability in opa plugin.

An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin.

This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2026
Last modified
Jun 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-492328.7Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of filCVE-2026-492337.5Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cacCVE-2026-492347.5When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. ThCVE-2026-492357.5When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.CVE-2026-492377.8An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch iCVE-2026-492388.4An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes witCVE-2026-49248.2Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attackeCVE-2026-492418.8The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side AnCVE-2026-492439.6Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link tCVE-2026-492445.9SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint fCVE-2026-492453.7SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file doCVE-2026-492461.7Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can