The forward‑auth plugin of Apache APISIX contains a header injection flaw. By altering the plugin’s configuration, an attacker can insert arbitrary HTTP headers into requests forwarded to downstream services. This can allow alteration of request handling, bypass of authentication controls, or modification of responses, thereby potentially compromising the integrity and confidentiality of exchanges.

Affected versions of Apache APISIX range from 2.12.0 through 3.15.0. The vulnerability is present in the forward‑auth plugin bundled with these releases, so any deployment utilizing that plugin for authentication forwarding is at risk.

The CVE does not report a CVSS score or EPSS data, and it is not listed in the KEV catalog, so no official severity or known exploits are recorded. The typical attack vector is inferred to be remote via HTTP traffic to the gateway, as the flaw is triggered by requests that reach the forward‑auth plugin. Given the lack of an in‑range patch and the ease of triggering the injection, the risk is likely moderate to high until an update is applied.