CVE-2026-48895
Last modified
CVE-2026-48895 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apisix | >= 3.0.0, < 3.17.0 |
References
- https://lists.apache.org/thread/yo1kq93ds69zbgjjopop7dmzm7zhj1gqVendor Advisory, Mailing List
- http://www.openwall.com/lists/oss-security/2026/06/19/11Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-48895?
How severe is CVE-2026-48895?
How do I fix CVE-2026-48895?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48885Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2…7.1
- CVE-2026-48886Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versi…9.3
- CVE-2026-48887Unauthenticated Broken Access Control in JS Help Desk <= 3.0…6.5
- CVE-2026-48889Subscriber Privilege Escalation in Amelia <= 2.3 versions.8.8
- CVE-2026-48891A bug in Apache Airflow's `/ui/dependencies` scheduling grap…4.3
- CVE-2026-48892The Config API in Apache Airflow surfaced per-key secrets-ba…6.5
- CVE-2026-48896Insufficient state checks lead to a vector that allows to by…7.5
- CVE-2026-48897Insufficient state checks lead to a vector that allows to by…7.5
- CVE-2026-48898An improper access check allows privilege escalation through…9.8
- CVE-2026-48899An improper access check allows privilege escalation through…9.8
- CVE-2026-4890A Denial of Service (DoS) vulnerability in the DNSSEC valida…7.5
- CVE-2026-48900An improper access check allowed low privileged users to edi…4.3
Are you affected by CVE-2026-48895?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST