CVE-2026-47339: Apache APISIX Auth Bypass Vulnerability

CVE-2026-47339 Overview

CVE-2026-47339 is an Incorrect Authorization vulnerability [CWE-863] in Apache APISIX, an open-source API gateway used for managing microservices traffic. The flaw resides in the authz-casdoor plugin when running under its default configuration. An attacker can authenticate to a protected APISIX route using credentials issued by a different identity source, bypassing the intended authorization boundary. The issue affects Apache APISIX versions 2.14.1 through 3.16.0. The project has released version 3.17.0 to remediate the flaw.

Critical Impact
Attackers with valid credentials from an unrelated Casdoor instance can authenticate to APISIX-protected APIs, breaking tenant isolation and exposing upstream services.

Affected Products

Apache APISIX 2.14.1 through 3.16.0
Deployments using the authz-casdoor plugin with default configuration
API gateways relying on Casdoor for authorization decisions

Discovery Timeline

2026-06-19 - CVE-2026-47339 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-47339

Vulnerability Analysis

Apache APISIX integrates with Casdoor, an identity and access management platform, through the authz-casdoor plugin. The plugin validates tokens issued by a Casdoor server and uses the response to authorize requests forwarded to upstream services. Under the default configuration, the plugin does not sufficiently bind the validated identity to the specific Casdoor application or tenant the route is configured for. An attacker holding valid credentials from any reachable Casdoor source can satisfy the authorization check and gain access to APIs routed through the gateway. The flaw is an authorization decision error rather than an authentication bypass, since the credentials are genuine but originate from an unintended issuer.

Root Cause

The root cause is missing validation of the issuer, application, or organization claims returned by Casdoor during the authorization step. The default plugin configuration accepts a successful Casdoor response as proof of authorization without verifying that the response originates from the expected Casdoor application context tied to the APISIX route.

Attack Vector

Exploitation requires network access to an APISIX instance exposing a route protected by the authz-casdoor plugin and valid credentials from any Casdoor source the plugin will accept. The attacker submits a request carrying these credentials. APISIX forwards the request to upstream services as if the user were authorized, exposing data and functionality intended for legitimate tenants. No user interaction is required, and the attack can be repeated programmatically against any vulnerable endpoint.

No public proof-of-concept code has been published. Technical details are described in the Apache Security Mailing List Update and the OpenWall OSS-Security Discussion.

Detection Methods for CVE-2026-47339

Indicators of Compromise

Successful authentications to APISIX routes from source IP ranges that do not match expected user populations.
Casdoor token validation events referencing application identifiers or organizations that are not associated with the protected route.
Upstream service access logs showing user principals that do not exist in the route's intended tenant directory.

Detection Strategies

Inspect APISIX access logs for requests handled by routes using the authz-casdoor plugin and correlate the authenticated principal with the expected Casdoor application.
Compare the iss and application claims of Casdoor tokens against the configured endpoint_addr and application binding for each route.
Alert on any 200-class response from a protected upstream where the authenticated user is not present in the tenant identity store.

Monitoring Recommendations

Forward APISIX gateway and Casdoor audit logs to a centralized analytics platform for cross-source correlation.
Track the version of Apache APISIX in production inventory and flag instances at or below 3.16.0.
Monitor outbound calls from APISIX worker nodes to Casdoor endpoints to identify unexpected issuer hosts.

How to Mitigate CVE-2026-47339

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0, which contains the fix for CVE-2026-47339.
Audit every route that enables the authz-casdoor plugin and review its configuration for explicit application and issuer bindings.
Rotate Casdoor client secrets and revoke active sessions issued during the exposure window.

Patch Information

Apache has released Apache APISIX 3.17.0 to address CVE-2026-47339. The fix is documented in the Apache Security Mailing List Update. Operators running versions from 2.14.1 through 3.16.0 must upgrade to remediate the vulnerability.

Workarounds

Disable the authz-casdoor plugin until upgrading is possible and substitute an alternative authorization plugin with strict issuer validation.
Restrict network access to APISIX administrative and data planes so that only trusted clients can reach routes that rely on Casdoor authorization.
Place an additional authorization layer in front of upstream services so that an isolated APISIX bypass does not directly expose backend APIs.

bash

# Verify the running Apache APISIX version and identify routes using authz-casdoor
apisix version
curl -s http://127.0.0.1:9180/apisix/admin/routes \
  -H "X-API-KEY: $ADMIN_KEY" | \
  jq '.list[] | select(.value.plugins."authz-casdoor" != null) | .value.id'