CVE-2026-39999: Apache APISIX Auth Bypass Vulnerability

CVE-2026-39999 Overview

CVE-2026-39999 is an Authentication Bypass by Spoofing vulnerability [CWE-290] affecting Apache APISIX, a cloud-native API gateway used to route and secure traffic for microservices. The flaw resides in the jwt-auth plugin and allows attackers to fully bypass authentication when certain plugin configurations are in use. Affected releases span from version v2.2 through v3.16.0. The Apache APISIX project addressed the issue in version v3.17.0. Because Apache APISIX commonly fronts internal services and APIs, a successful bypass exposes downstream applications to unauthenticated access.

Critical Impact
Attackers can spoof authentication and gain unauthorized access to APIs protected by the jwt-auth plugin, exposing backend services to abuse.

Affected Products

Apache APISIX v2.2 through v3.16.0
Deployments using the jwt-auth plugin with vulnerable configurations
API gateways fronting microservices that rely on APISIX for authentication enforcement

Discovery Timeline

2026-06-19 - CVE-2026-39999 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-39999

Vulnerability Analysis

The vulnerability stems from how the Apache APISIX jwt-auth plugin validates incoming JSON Web Tokens (JWTs) under specific configurations. When the plugin is configured in a vulnerable state, attackers can craft requests that the plugin treats as authenticated despite lacking valid credentials. This breaks the trust boundary that API consumers rely on to protect backend services.

The impact is constrained to authentication spoofing rather than data corruption or remote code execution. However, because API gateways act as the primary enforcement layer for many architectures, a bypass at this layer cascades to every upstream service that trusts the gateway's authentication decision. Apache APISIX users running any version from v2.2 through v3.16.0 are exposed if the affected plugin configuration is present.

Root Cause

The root cause is improper verification of identity claims by the jwt-auth plugin under certain configurations, classified as Authentication Bypass by Spoofing [CWE-290]. The plugin accepts tokens or request attributes that should be rejected, allowing attackers to assume the identity of authenticated principals without presenting valid signing material.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker reaches the APISIX gateway over its exposed listener and submits crafted HTTP requests targeting routes protected by the jwt-auth plugin. If the gateway is configured in the vulnerable manner, the plugin returns a successful authentication result and forwards the request to upstream services.

No verified public exploit code is available at the time of writing. Refer to the Apache Thread Discussion and the OpenWall OSS-Security Post for technical details from the project maintainers.

Detection Methods for CVE-2026-39999

Indicators of Compromise

Requests to routes protected by the jwt-auth plugin that succeed without a valid Authorization header or with malformed JWT structures.
Unexpected upstream activity from API consumers that should require authentication, particularly across administrative or privileged endpoints.
APISIX access logs showing authentication success events tied to unusual client IPs, user agents, or request shapes.

Detection Strategies

Audit APISIX route definitions to identify all routes using the jwt-auth plugin and verify the configuration against the version v3.17.0 documentation.
Compare gateway authentication outcomes with upstream application logs to identify divergence where the gateway granted access but the application has no record of a known principal.
Inspect APISIX deployment versions across environments and flag any instances running v2.2 through v3.16.0.

Monitoring Recommendations

Enable verbose logging on the jwt-auth plugin and forward logs to a centralized analytics platform for anomaly review.
Alert on spikes in authenticated traffic to sensitive APIs that do not correlate with normal user populations.
Track failed-to-successful authentication ratios per route to surface configurations that may be incorrectly permitting access.

How to Mitigate CVE-2026-39999

Immediate Actions Required

Upgrade Apache APISIX to version v3.17.0 or later on all gateway nodes.
Inventory every route that loads the jwt-auth plugin and review its configuration against current project guidance.
Rotate JWT signing keys and revoke long-lived tokens that may have been accepted during the exposure window.

Patch Information

The Apache APISIX project released version v3.17.0 to remediate CVE-2026-39999. Administrators should plan a rolling upgrade across gateway clusters and validate that jwt-auth routes continue to enforce authentication after the upgrade. Confirmation details are available in the Apache Thread Discussion.

Workarounds

If immediate upgrade is not feasible, restrict access to APISIX listeners using network controls so only trusted clients can reach routes protected by jwt-auth.
Layer an additional authentication control (such as mTLS or a secondary auth plugin) in front of sensitive routes until the upgrade completes.
Disable the jwt-auth plugin on non-essential routes and require alternative, verified authentication mechanisms while patching is scheduled.

bash

# Verify the installed Apache APISIX version and upgrade path
apisix version
# Expected output after remediation: 3.17.0 or later