CVE-2026-44046
Apache Apisix 1.2 – 3.17.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-44046 is a low-severity Use of Less Trusted Source (CWE-348) vulnerability in Apache Apisix. Its CVSS base score is 2.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-38014
Vulnerability Data
Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from…
more
1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing Apache APISIX directly enables exploitation to bypass IP-based access controls via spoofed identity data.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access decisions using only trusted identity and source attributes, blocking exploitation of spoofed values from less-trusted sources such as the wolf-rbac plugin.
Requires cryptographic or protocol-level identification and authentication rather than relying on client-supplied or IP-based identifiers that can be spoofed under default configuration.
Enforces boundary protection and validates external source addresses at trusted network layers, mitigating IP-based access-control bypasses that stem from untrusted header data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit authenticity/integrity checks before use directly reduce selection of a less-trusted source.
Correlating multiple sources can surface discrepancies that discourage reliance on the less-trusted one.
Protecting data-in-transit integrity helps ensure the more-trusted source is the one whose data is accepted.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles include trusted input channels and source verification mechanisms.
Security testing can detect and prevent acceptance of data from less-trusted sources during development.
Network security controls can enforce trusted data paths and source validation, reducing reliance on unverified inputs.
Secure network services include source validation and integrity checks that help prevent acceptance of data from less-trusted origins.
Application security requirements can mandate trusted data sources and input validation, directly addressing the weakness.
Secure coding practices can enforce checks that prefer or validate the more trusted data source.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-348
Oracle Linux 9 (1 rule)
- V-271525 OL 9 must have GPG signature verification enabled for all software repositories. via CWE-348