CVE-2026-47341: Apache APISIX Auth Bypass Vulnerability

CVE-2026-47341 Overview

CVE-2026-47341 is an authentication bypass vulnerability affecting Apache APISIX, an open-source API gateway used to route, secure, and observe API traffic. The flaw resides in the hmac-auth plugin, where specific configurations allow an attacker to capture a valid authentication token and replay it indefinitely. Token expiry checks fail to enforce time-bound validity, enabling persistent unauthorized access. The issue affects Apache APISIX versions 3.11.0 through 3.16.0 and is tracked under CWE-294: Authentication Bypass by Capture-replay. Apache has released version 3.17.0 to address the flaw.

Critical Impact
Attackers with access to a captured HMAC token can reuse it indefinitely, bypassing expiry controls and gaining persistent unauthorized access to protected API routes.

Affected Products

Apache APISIX 3.11.0 through 3.16.0
Deployments using the hmac-auth plugin with vulnerable configurations
API gateway environments relying on APISIX HMAC token expiry

Discovery Timeline

2026-06-19 - CVE-2026-47341 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-47341

Vulnerability Analysis

Apache APISIX provides the hmac-auth plugin to authenticate API consumers using Hash-based Message Authentication Code (HMAC) signatures. The plugin typically validates a signed request along with a timestamp to prevent replay. Under certain configurations in affected versions, the expiry enforcement does not function as intended. An attacker who observes or otherwise obtains a valid signed token can replay the same token repeatedly, with no time window restricting its validity.

The vulnerability has a network attack vector and requires no privileges or user interaction, although successful exploitation depends on the attacker first capturing a valid token. Impact is limited to subsequent subsystems reached through the gateway, as the gateway itself does not expose its own confidentiality or integrity directly. However, downstream services protected only by hmac-auth become reachable to the attacker.

Root Cause

The root cause is improper enforcement of token expiry within the hmac-auth plugin. When certain configuration options are active, the signature validation routine accepts tokens without rejecting those whose timestamp falls outside the configured validity window. This breaks the freshness guarantee that HMAC authentication schemes rely on to defeat replay attacks, mapping directly to CWE-294.

Attack Vector

An attacker captures a legitimate HMAC-signed request through network interception, log exposure, browser history, or any side channel that reveals the signed token. The attacker then resubmits the same request, or a request bearing the same signature components, to the APISIX gateway. Because expiry validation does not reject the stale token, the gateway treats the replayed request as authentic and forwards it to the upstream service. The attacker can repeat this indefinitely until the underlying credential is rotated.

No verified public proof-of-concept code is available for CVE-2026-47341. Refer to the Apache mailing list announcement and the Openwall OSS-Security advisory for technical details.

Detection Methods for CVE-2026-47341

Indicators of Compromise

Repeated API requests carrying identical HMAC signature values across long time intervals.
Successful authenticated requests originating from IP addresses or user agents inconsistent with the legitimate API consumer.
Access to protected upstream endpoints from clients whose HMAC timestamps are significantly older than the configured validity window.

Detection Strategies

Inspect APISIX access logs for duplicate X-HMAC-SIGNATURE or equivalent header values reused across multiple sessions.
Correlate request timestamps embedded in HMAC payloads against the request arrival time to identify stale tokens being accepted.
Enable verbose logging on the hmac-auth plugin and alert when the same key identifier authenticates from divergent network locations.

Monitoring Recommendations

Forward APISIX gateway logs to a centralized analytics platform and baseline normal HMAC token usage patterns per consumer.
Monitor upstream service authentication metrics for anomalies such as bursts of identical signed requests.
Track Apache APISIX version inventory across environments to flag any instance still running 3.11.0 through 3.16.0.

How to Mitigate CVE-2026-47341

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0 or later, which contains the fix for the hmac-auth expiry enforcement flaw.
Rotate all HMAC keys configured under the hmac-auth plugin to invalidate any previously captured tokens.
Audit hmac-auth plugin configurations across all routes and consumers to confirm expiry settings are active after the upgrade.

Patch Information

Apache has released APISIX 3.17.0, which resolves CVE-2026-47341 by correcting HMAC token expiry validation in the hmac-auth plugin. The fix details and upgrade guidance are published in the Apache APISIX security announcement. Operators running affected versions should plan the upgrade as the primary remediation.

Workarounds

Disable the hmac-auth plugin on sensitive routes and substitute an alternative authentication mechanism such as jwt-auth or key-auth with rotation until the upgrade is applied.
Place an additional reverse proxy in front of APISIX that enforces request timestamp validation independently of the gateway.
Restrict network access to the APISIX gateway using IP allowlists or mutual TLS to reduce the population of clients capable of replaying captured tokens.

bash

# Verify the installed APISIX version
apisix version

# Upgrade APISIX (example for source-based deployments)
# Replace with your environment's package manager or container image tag
docker pull apache/apisix:3.17.0-debian
docker stop apisix && docker rm apisix
docker run -d --name apisix -p 9080:9080 -p 9443:9443 apache/apisix:3.17.0-debian

# Rotate HMAC consumer keys via the Admin API
curl -X PUT http://127.0.0.1:9180/apisix/admin/consumers/example \
  -H 'X-API-KEY: <admin-key>' \
  -d '{
    "username": "example",
    "plugins": {
      "hmac-auth": {
        "access_key": "new-access-key",
        "secret_key": "new-secret-key",
        "clock_skew": 300
      }
    }
  }'