CVE-2026-44087 is a critical flaw (CVSS 9.1) in the openid-connect plugin of Apache APISIX, versions 2.3 through 3.16.0. In its default setup an attacker can spoof identity headers and reach protected resources. The sources disagree on the fixed version, 3.16.1 or 3.17.0, so upgrade to 3.17.0.
What's affected
The Apache announcement and the NVD record both say APISIX 2.3 through 3.16.0 is affected. They differ on the fix. The NVD record says upgrade to 3.17.0. The oss-security copy of the Apache announcement says 3.16.1.
Because the two disagree, choose 3.17.0 or later, which is newer than both, and check the Apache announcement.
How to check if you're exposed
apisix version
For containers, read the image tag. Then list the routes that use the openid-connect plugin. Those routes are the exposed ones. Check whether any back end service trusts identity headers that APISIX sets, such as user or token claims in headers, since a spoofed header would reach it.
What to do now
- Upgrade Apache APISIX to 3.17.0 or later.
- List routes with the openid-connect plugin and note which back ends trust identity headers.
- Make back ends verify tokens themselves where they can, rather than trusting headers alone.
- Strip identity headers from incoming client requests at the edge.
- Check access logs for requests with unexpected identity headers.
Why it matters
The weakness is CWE-345, insufficient verification of data authenticity. A gateway that sets identity headers after login must also remove any copies that the client sent. If it does not, a client can claim to be someone else, and services downstream believe it.
No login or user action is needed, and confidentiality and integrity impacts are high. The KEV flag is false, and the announcement does not claim exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version should I install, 3.16.1 or 3.17.0?
The NVD record names 3.17.0 and the oss-security copy names 3.16.1. Use 3.17.0 or later and confirm on the Apache page.
Sources
- Apache announcement on oss-security
- Apache mailing list thread (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
