CVE-2026-44046

The record

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before… CWE-348
• CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-348
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-348
• CVE-2026-16732 fastify is a fast and low overhead web framework for Node.js. CWE-348
• CVE-2026-25552 Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated… CWE-348
• CVE-2026-63220 CodeIgniter is a PHP full-stack web framework. CWE-348
• CVE-2026-50243 In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with… CWE-348
• CVE-2026-63770 Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication… CWE-348