https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T16:02:53.589814+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-39998 CVE-2026-39998 — Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup 2026-09-29T16:02:56.544218+00:00

Affected: Apache Software Foundation Apache APISIX

Improper Input Validation vulnerability in Apache APISIX.

The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.