Apache Software Foundation Apache APISIX forward-auth plugin permits header injection

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

• Apache Software Foundation Apache APISIX: affected from version 2.12.0 through and including version 3.15.0 under semver. The recorded default status is unaffected.
• Apache recommends upgrading to version 3.16.0, which is identified as the fixed release.
• The record does not separately establish the status of parallel branches or releases outside the stated range. Do not infer that every such branch is safe solely from the fixed-release statement.

This is classified as CWE-75, where special elements are not adequately separated or sanitized before being placed into another context. The affected component is the Apache APISIX forward-auth plugin. At a high level, an attacker can provide data that reaches the plugin's processing path when a certain configuration is used, causing malicious headers to be injected into a related request or response flow. The available assessment characterizes the attack as network-reachable, low complexity, unauthenticated, and requiring no user interaction. The record does not identify the specific configuration, header names, processing function, endpoint, or downstream consumer, so the exact outcome depends on the deployment and how other systems consume the headers.

The issue can be reached over the network when Apache APISIX uses the forward-auth plugin with a configuration within the affected conditions. The supplied assessment describes an attack that requires no prior privileges, no user interaction, and low complexity. The record does not identify a public exploit, and CISA enrichment records exploitation as none at the time of that assessment. This status does not prove that every deployment is safe or that unreported exploitation cannot occur.

Successful exploitation can place malicious headers into the processing flow of components behind Apache APISIX. The available assessment indicates potentially serious confidentiality and integrity consequences, while it does not identify an availability consequence. The actual effect depends on whether downstream services trust those headers for security-sensitive or request-processing decisions. The record does not establish code execution, privilege escalation, or a specific impact on any downstream system.

An attacker may influence headers forwarded to or processed by components behind Apache APISIX. Depending on how much trust those services place in the headers, this could alter authentication, authorization, or data-processing decisions and affect confidentiality and integrity. The operational consequence depends on the integration architecture and forward-auth configuration; the record does not name a victim, campaign, or specific breach. The lack of a named incident should not be treated as evidence that an environment is not exposed.

1. Upgrade Apache APISIX to version 3.16.0, the fixed release identified by Apache in the available evidence.
2. Inventory all instances and confirm that deployments using forward-auth have been upgraded, including nodes that do not directly receive public traffic.
3. If an immediate upgrade is not possible, review and, where operationally safe, temporarily remove or restrict the suspected affected forward-auth configuration until the upgrade is complete. This is a local precaution, not a vendor-confirmed workaround.
4. After upgrading, test authentication flows and verify that headers are forwarded according to the intended design. Keep the plugin configuration to the minimum required and monitor for unexpected header changes in requests passing through it.

1. Inventory Apache APISIX instances and compare their running versions with the affected branches listed in the scope section.
2. Identify deployments that enable or use the forward-auth plugin.
3. Review the plugin configuration for the particular configuration conditions that could allow data from the authentication flow to enter a header; the available source does not name the relevant configuration key.
4. Review APISIX and downstream-service logs for unexpected headers, unauthorized headers, or unexplained changes in requests passing through forward-auth. This is precautionary monitoring, not a confirmed IOC.
5. After remediation, verify that the instance is running the vendor-fixed release and retest authentication flows and expected header behavior. The absence of anomalous log evidence does not prove that the deployment was not exposed.