https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T20:25:22.059789+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-apisix-2026-49231 BIT-apisix-2026-49231 — Apache APISIX: Identity spoofing issue in APISIX opa plugin 2026-10-05T20:25:22.107051+00:00

Affected: Bitnami: apisix

Authentication Bypass by Spoofing vulnerability in opa plugin.

An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin.

This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-328979 EUVD-2026-328979 2026-10-05T20:25:22.107112+00:00 EUVD-2026-328979 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49231 fkie_cve-2026-49231 2026-10-05T20:25:22.107128+00:00

Authentication Bypass by Spoofing vulnerability in opa plugin.

An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin.

This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-3cm7-pvjf-2x7q GHSA-3cm7-pvjf-2x7q 2026-10-05T20:25:22.107154+00:00

Authentication Bypass by Spoofing vulnerability in opa plugin.

An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin.

This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.