CVE-2026-31908 | Apache APISIX up to 3.15.0 Forward Auth Plugin injection

A vulnerability marked as critical has been reported in Apache APISIX up to 3.15.0. Affected by this vulnerability is an unknown functionality of the component Forward Auth Plugin. Performing a manipulation results in injection.

This vulnerability is identified as CVE-2026-31908. The attack can be initiated remotely. There is not any exploit available.

It is suggested to upgrade the affected component.