Apache APISIX’s wolf‑rbac plugin accepts identity data from a less trusted source, allowing an attacker to insert forged identity information into logs and to potentially bypass IP‑based access control rules. This flaw is classified as CWE‑348, where trust is improperly applied. The consequence is that an adversary can have their identity reflected in audit records and may gain unauthorized access by mixing with IP restrictions.

The issue affects Apache APISIX versions from 1.2.0 through 3.16.0, which are the releases that include the wolf‑rbac plugin with its default configuration.

The CVSS score of 2.3 indicates low overall risk, and with no EPSS data the likelihood of exploitation remains uncertain, though the vulnerability is not listed in CISA’s KEV catalog. The attacker can exploit the flaw via the plugin’s default configuration, sending spoofed identity headers; the attack requires only the ability to tamper with identity information presented to the plugin. Because the flaw relies on a trusted source being mis‑classified, it does not require privileged access or complex exploitation steps.