CVE-2026-44046 Details
Description
Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.
A vulnerability allowing identity spoofing has been identified in the Apache APISIX wolf-rbac plugin, affecting versions 1.2.0 prior to 3.16.0. Under default configuration, this vulnerability can be exploited to inject fake identity information into logs and manipulate IP-based access control rules.
Users are advised to upgrade to Apache APISIX version 3.17.0 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/06/19/6 | CVE | Third Party Advisory |
| https://lists.apache.org/thread/xkshmps51b24yw0qckl5h5ddyv0x6qf9 | [email protected] | Vendor AdvisoryMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apisix | >= 1.2, < 3.17.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | CVE Modified | CVE |
| Jun 19, 2026 | New CVE Received | [email protected] |