CVE-2026-31923: Apache APISIX Information Disclosure Flaw

CVE-2026-31923 Overview

A Cleartext Transmission of Sensitive Information vulnerability has been identified in Apache APISIX, a popular open-source API gateway. This vulnerability stems from an insecure default configuration in the openid-connect plugin, where the ssl_verify parameter is set to false by default. This configuration flaw allows sensitive authentication information to be transmitted without proper TLS certificate verification, potentially exposing credentials and tokens to interception by malicious actors.

Critical Impact

Sensitive authentication data including OAuth tokens, user credentials, and session information may be intercepted by attackers performing man-in-the-middle attacks due to disabled SSL/TLS certificate verification.

Affected Products

• Apache APISIX versions 0.7 through 3.15.0
• Deployments using the openid-connect plugin with default configuration
• API gateway instances configured without explicit ssl_verify settings

Discovery Timeline

• 2026-04-14 - CVE-2026-31923 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-31923

Vulnerability Analysis

This vulnerability (CWE-319: Cleartext Transmission of Sensitive Information) affects the openid-connect plugin in Apache APISIX. When organizations deploy APISIX with OpenID Connect authentication, the plugin communicates with identity providers to validate tokens and authenticate users. The security flaw lies in the default configuration where ssl_verify is set to false, meaning the plugin will not validate the SSL/TLS certificates presented by the identity provider.

Without proper certificate verification, the communication channel between APISIX and the identity provider becomes vulnerable to interception. An attacker positioned on the network path can present a fraudulent certificate, intercept the authentication traffic, and capture sensitive information including OAuth access tokens, refresh tokens, and potentially user credentials being exchanged during the authentication flow.

Root Cause

The root cause of this vulnerability is an insecure default configuration in the openid-connect plugin. By setting ssl_verify to false by default, the plugin accepts any SSL/TLS certificate without validation, effectively disabling one of the fundamental security controls in encrypted communications. This design decision, likely made to simplify initial deployment and testing, creates a significant security gap in production environments where certificate validation is essential.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access between the APISIX gateway and the OpenID Connect identity provider can perform a man-in-the-middle attack. By intercepting the TLS handshake and presenting a self-signed or fraudulent certificate, the attacker can decrypt, view, and potentially modify the authentication traffic. This could lead to session hijacking, credential theft, or unauthorized access to protected resources.

The attack scenario involves:

1. An attacker positions themselves on the network path between APISIX and the identity provider (e.g., through ARP spoofing or DNS poisoning)
2. APISIX initiates a connection to the identity provider for token validation
3. The attacker intercepts the connection and presents their own certificate
4. Due to disabled certificate verification, APISIX accepts the fraudulent certificate
5. Sensitive authentication data flows through the attacker's system in cleartext

Detection Methods for CVE-2026-31923

Indicators of Compromise

• Unexpected SSL/TLS certificate changes or mismatches in network traffic logs between APISIX and identity providers
• Authentication failures or anomalies following successful initial authentication flows
• Network traffic to identity provider endpoints originating from unexpected IP addresses
• User reports of session hijacking or unauthorized account access

Detection Strategies

• Review APISIX configuration files and plugin settings for ssl_verify: false in openid-connect plugin configurations
• Implement network monitoring to detect certificate anomalies in traffic between APISIX and identity providers
• Deploy intrusion detection systems with rules to identify potential MITM attacks on authentication flows
• Audit API gateway logs for authentication patterns that deviate from normal baselines

Monitoring Recommendations

• Enable detailed logging for the openid-connect plugin to capture certificate validation events
• Monitor for configuration changes to APISIX plugins, particularly security-related parameters
• Implement alerting for any SSL/TLS certificate warnings or errors in gateway communications
• Conduct regular configuration audits to ensure ssl_verify remains enabled in production

How to Mitigate CVE-2026-31923

Immediate Actions Required

• Audit all Apache APISIX deployments running versions 0.7 through 3.15.0 for openid-connect plugin usage
• Explicitly set ssl_verify: true in all openid-connect plugin configurations immediately
• Review network traffic logs for signs of previous exploitation or MITM activity
• Rotate any OAuth tokens or credentials that may have been exposed through unverified connections

Patch Information

Users are recommended to upgrade to Apache APISIX version 3.16.0, which addresses this vulnerability by fixing the insecure default configuration. The upgrade should be tested in a staging environment before deployment to production to ensure compatibility with existing configurations. For additional technical details, refer to the Apache Mailing List Thread or the Openwall OSS Security Post.

Workarounds

• Explicitly configure ssl_verify: true in all openid-connect plugin route configurations
• Ensure proper CA certificates are installed and accessible to the APISIX instance
• Implement network segmentation to limit exposure between APISIX and identity providers
• Consider using mutual TLS (mTLS) for additional authentication between services

# Configuration example - Enable SSL verification in openid-connect plugin
# Add or modify the ssl_verify parameter in your APISIX route configuration

# Example route configuration with secure ssl_verify setting:
# plugins:
#   openid-connect:
#     client_id: "your-client-id"
#     client_secret: "your-client-secret"
#     discovery: "https://your-idp/.well-known/openid-configuration"
#     ssl_verify: true    # CRITICAL: Set to true to enable certificate verification
#     realm: "your-realm"