CVE-2026-48895

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://lists.apache.org/thread/yo1kq93ds69zbgjjopop7dmzm7zhj1gq	Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2026/06/19/11	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de redirección de URL a sitio no confiable (’Redirección abierta’) en Apache APISIX. El atacante podría manipular algunos encabezados del cliente para realizar una redirección abierta, para exponer potencialmente el token de sesión. Este problema afecta a Apache APISIX: desde la 3.0.0 hasta la 3.16.0. Se recomienda a los usuarios actualizar a la versión 3.17.0, que soluciona el problema.

Information

Published : 2026-06-19 14:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-48895

Mitre link : CVE-2026-48895

CVE.ORG link : CVE-2026-48895

JSON object : View

Products Affected

apache

apisix

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-48895", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48895", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T16:20:23.765787Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache APISIX", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "3.16.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-19T14:16:23.310", "references": [{"url": "https://lists.apache.org/thread/yo1kq93ds69zbgjjopop7dmzm7zhj1gq", "tags": ["Vendor Advisory", "Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/19/11", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.\n\nThe attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token.\n\nThis issue affects Apache APISIX: from 3.0.0 through 3.16.0.\n\nUsers are recommended to upgrade to version 3.17.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de redirecci\u00f3n de URL a sitio no confiable (\u2019Redirecci\u00f3n abierta\u2019) en Apache APISIX.\n\nEl atacante podr\u00eda manipular algunos encabezados del cliente para realizar una redirecci\u00f3n abierta, para exponer potencialmente el token de sesi\u00f3n.\n\nEste problema afecta a Apache APISIX: desde la 3.0.0 hasta la 3.16.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.17.0, que soluciona el problema."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46461E65-7CF7-491D-A104-C4A6A08C4527", "versionEndExcluding": "3.17.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}