CVE-2026-31923
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.
- Score
- CVSS 3.1 7.5 High
- Status
- Analyzed - security@apache.org
- Published
- 2026-04-14
- Last modified
- 2026-10-26
- Weaknesses
- CWE-319
Affected products
References
- https://lists.apache.org/thread/0pjs72l7qj83j3srw1l1toyj24bsgkds
- http://www.openwall.com/lists/oss-security/2026/04/14/1
