CVE-2026-48895: Apache APISIX Open Redirect Vulnerability (v3.0.0–3.16.0)

Technical summary

The vulnerability (CWE-601) exists in APISIX's URL redirection logic, where insufficient validation of client-controlled headers permits an attacker to craft requests that redirect users to arbitrary external sites. The attack requires no authentication, can be triggered over the network without special conditions, and impacts the integrity and confidentiality of user sessions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects network-exploitable, low-complexity exploitation with cross-boundary scope impact.

Business impact

An open-redirect vulnerability in an API gateway creates a high-profile attack surface. Threat actors can use APISIX instances as pivot points to steal authentication credentials, capture session tokens, or conduct phishing attacks that appear to originate from a trusted organization's infrastructure. For enterprises running APISIX in production, this exposes both direct users and downstream API consumers to credential theft and session hijacking. Reputational damage and compliance violations (e.g., GDPR incident notification) are secondary risks if user data is exfiltrated via this vector.

Affected systems

Apache APISIX versions 3.0.0 through 3.16.0 are vulnerable. Organizations running APISIX as an API gateway, reverse proxy, or service mesh control plane with these versions should inventory their deployments immediately. Version 3.17.0 and later versions contain the fix. The vulnerability does not affect APISIX versions prior to 3.0.0.

Exploitability

This vulnerability is straightforward to exploit and requires no authentication or special preconditions. An attacker can trigger the open-redirect by sending a specially crafted request with manipulated headers to any APISIX instance exposed on the network. User interaction (e.g., clicking a malicious link) may be needed to harvest credentials, but the vulnerability itself is not dependent on user action—the redirect mechanism is automatically triggered by APISIX. The attack is network-accessible from any vantage point, making it remotely exploitable at scale.

Remediation

Upgrade Apache APISIX to version 3.17.0 or later. This is the definitive fix. Organizations unable to upgrade immediately should review network exposure of APISIX instances, restrict external access where possible, and monitor redirect logs for suspicious patterns. Consider implementing a WAF rule to detect or block suspicious client headers that could trigger redirects, though this is a temporary control pending patching.

Patch guidance

1. Verify your current APISIX version (apisix -v or check your deployment manifests). 2. Review the official Apache APISIX release notes for version 3.17.0 to understand any breaking changes or new dependencies. 3. Test the upgrade in a non-production environment first, particularly if you have custom plugins or middleware that may interact with request headers. 4. Plan a rolling or blue-green deployment to minimize downtime. 5. After upgrading, validate that client redirect functionality works as intended and that security monitoring continues to operate normally.

Detection guidance

Monitor APISIX access and error logs for unusual redirect responses (HTTP 301/302) sent to external domains. Examine client headers (particularly Host, Referer, X-Forwarded-For, and custom headers) in requests that precede redirect responses. Use SIEM correlation rules to identify patterns where APISIX is redirecting to known malicious or non-organization domains. Also monitor for authentication logs showing session tokens or cookies being accessed from unexpected geographies or IP ranges, which may indicate post-compromise activity from harvested credentials.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.2) due to network-exploitable access, low attack complexity, and potential exposure of session tokens—a direct path to account takeover. Unlike vulnerabilities requiring user interaction or authentication, this can be attacked without friction. It affects a critical infrastructure component (API gateway) that typically sits in a high-trust network position, amplifying the business impact. Immediate patching is strongly advised for any organization running affected versions in production.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects: (1) Attack Vector: Network—remotely exploitable with no special access; (2) Attack Complexity: Low—no special conditions or timing required; (3) Privileges Required: None—unauthenticated exploitation is possible; (4) User Interaction: None—the redirect is automatic, though credential harvesting may benefit from social engineering; (5) Scope: Changed—the vulnerability affects API consumers and end users beyond the direct APISIX system; (6) Confidentiality & Integrity: Low impact each—session tokens and redirect behavior are compromised, but not the entire system. Availability is not impacted. The 'HIGH' severity bucket warrants immediate executive attention and patch prioritization.

Frequently asked questions