CVE-2026-49230: Apache APISIX Auth Bypass Vulnerability

CVE-2026-49230 Overview

CVE-2026-49230 is an authentication bypass vulnerability in Apache APISIX, an open-source API gateway. The flaw resides in the jwe-decrypt plugin under its default configuration. Improper validation of the integrity check value [CWE-354] allows network-based attackers to bypass JSON Web Encryption (JWE) authentication without prior privileges or user interaction. The issue affects Apache APISIX from version 3.8.0 through 3.16.0. The Apache Software Foundation has released version 3.17.0 to remediate the issue.

Critical Impact
Attackers can bypass authentication on API endpoints protected by the jwe-decrypt plugin, potentially accessing protected upstream services without valid credentials.

Affected Products

Apache APISIX 3.8.0 through 3.16.0
Deployments using the jwe-decrypt plugin under default configuration
API gateways relying on JWE-based authentication via APISIX

Discovery Timeline

2026-06-19 - CVE-2026-49230 published to NVD
2026-06-19 - Apache Software Foundation disclosed the issue on the project mailing list
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49230

Vulnerability Analysis

The jwe-decrypt plugin in Apache APISIX implements JSON Web Encryption to authenticate and decrypt incoming tokens before forwarding requests to upstream services. The plugin under default configuration does not properly validate the integrity check value associated with the encrypted token. This weakness corresponds to [CWE-354] Improper Validation of Integrity Check Value.

When integrity validation is incomplete, an attacker can craft a token whose ciphertext or authentication tag is not adequately verified. The plugin accepts the malformed token as valid and routes the request to the protected upstream as if it had been authenticated. The result is an authentication bypass that exposes resources intended to be reachable only after successful JWE decryption.

The attack is network-reachable, requires low attack complexity, and needs no prior authentication or user interaction. Exploitation depends on the target deployment configuration (AT:P in the CVSS 4.0 vector), reflecting that the plugin must be active under default settings.

Root Cause

The root cause is missing or insufficient verification of the JWE authentication tag during the decryption routine in the jwe-decrypt plugin. Without enforcing the cryptographic integrity check, tampered or forged tokens are not rejected, breaking the security guarantee of the authenticated encryption scheme.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to an APISIX route that uses the jwe-decrypt plugin. The attacker supplies a crafted JWE token that fails proper integrity validation. The plugin processes the request and passes it to the protected upstream, granting access without valid credentials. No additional privileges or user interaction are required.

No verified public proof-of-concept exploit is currently available. See the Apache Mailing List Discussion and the Openwall OSS-Security Update for additional technical context.

Detection Methods for CVE-2026-49230

Indicators of Compromise

Unexpected upstream requests originating from routes protected by the jwe-decrypt plugin that lack corresponding successful authentication events.
Access log entries showing malformed or unusually structured Authorization headers carrying JWE tokens.
Spikes in 2xx responses for endpoints that historically required authenticated JWE tokens.

Detection Strategies

Audit Apache APISIX configuration to identify all routes using the jwe-decrypt plugin and confirm the running version.
Correlate gateway access logs with upstream application logs to find requests that reached the backend without a valid authenticated session.
Monitor for requests containing JWE tokens with invalid or missing authentication tags, which should be rejected post-patch.

Monitoring Recommendations

Forward Apache APISIX access and error logs to a centralized SIEM for retention and correlation with upstream service telemetry.
Alert on anomalous request patterns to JWE-protected routes, including bursts from single source IP addresses and uncommon user agents.
Track APISIX version inventory continuously to detect any gateway instances still running 3.8.0 through 3.16.0.

How to Mitigate CVE-2026-49230

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0 or later, which contains the fix for CVE-2026-49230.
Inventory all gateway instances and confirm none remain on versions 3.8.0 through 3.16.0.
Review every route that enables the jwe-decrypt plugin and assess exposure during the remediation window.

Patch Information

Apache APISIX 3.17.0 fixes the improper integrity validation in the jwe-decrypt plugin. Refer to the Apache Mailing List Discussion for the official advisory and upgrade guidance.

Workarounds

Temporarily disable the jwe-decrypt plugin on affected routes until the upgrade to 3.17.0 is completed.
Place additional authentication layers, such as key-auth or jwt-auth, in front of routes that currently rely solely on jwe-decrypt.
Restrict network access to the APISIX data plane using firewall rules or service mesh policies while patching is in progress.

bash

# Configuration example: disable jwe-decrypt on an affected route until patched
curl -X PATCH http://127.0.0.1:9180/apisix/admin/routes/<route_id> \
  -H "X-API-KEY: <admin_key>" \
  -d '{
    "plugins": {
      "jwe-decrypt": null
    }
  }'