CVE-2026-49871: Apache Apisix CSRF Vulnerability

CVE-2026-49871 Overview

CVE-2026-49871 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the cas-auth plugin in Apache APISIX under default configurations. An attacker who lures a victim to a malicious webpage can cause the victim's browser to authenticate as a different identity controlled by the attacker. Any upstream actions the victim performs are then attributed to the attacker's identity, creating an integrity and traceability problem in audit trails. The flaw affects Apache APISIX versions 3.0.0 through 3.16.0 and is fixed in version 3.17.0.

Critical Impact
Victim sessions can be silently re-authenticated as an attacker-controlled identity, causing subsequent actions to be logged under the wrong principal.

Affected Products

Apache APISIX 3.0.0 through 3.16.0
Deployments using the cas-auth plugin under default configurations
API gateways relying on CAS (Central Authentication Service) single sign-on integration via APISIX

Discovery Timeline

2026-06-19 - CVE-2026-49871 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49871

Vulnerability Analysis

The cas-auth plugin in Apache APISIX integrates the gateway with a CAS server to perform single sign-on for upstream applications. Under default configurations, the plugin does not adequately protect the authentication callback flow against cross-site request forgery. An attacker hosting a crafted page can trigger the victim's browser to complete an authentication exchange using an attacker-supplied service ticket or session state. The result is a session bound to the attacker's identity rather than the victim's.

This is a classic login CSRF scenario. The victim continues to use the application believing they are operating under their own identity, while the gateway has associated their browser with the attacker's account. Actions performed against upstream services are attributed to the attacker, which corrupts audit data, undermines non-repudiation, and can be leveraged to capture sensitive information the victim enters into the attacker-controlled session.

Root Cause

The root cause is missing CSRF protection on state-changing authentication endpoints in the cas-auth plugin. The plugin's default configuration accepts the CAS callback without binding the request to a prior, unforgeable client-side state value such as a properly validated state parameter or anti-CSRF token tied to the victim's pre-authentication session.

Attack Vector

Exploitation requires the attacker to host a page that triggers a request to the APISIX CAS callback endpoint while the victim browses it. User interaction is required as reflected in the CVSS 4.0 vector. No credentials or prior access to the target gateway are needed. Detailed analysis is available in the Apache Security Announcement and the Openwall OSS-Security Update.

Detection Methods for CVE-2026-49871

Indicators of Compromise

Authentication callback requests to the cas-auth plugin endpoint with a Referer header pointing to an external, untrusted domain.
Session identity changes for an active client IP without an explicit logout event in gateway access logs.
Audit entries showing upstream actions attributed to user accounts that did not initiate a fresh authentication from a trusted login page.

Detection Strategies

Inspect APISIX access logs for CAS callback hits that lack a same-origin Referer or that occur outside of an established login workflow.
Correlate CAS service ticket validations with the originating client session to identify mid-session identity reassignments.
Hunt for repeated callback invocations from the same client within short time windows, which can indicate forced re-authentication attempts.

Monitoring Recommendations

Forward APISIX and CAS server logs to a centralized analytics platform and alert on identity transitions within a single browser session.
Track the version of Apache APISIX deployed in each environment and flag any instance running 3.0.0 through 3.16.0 with cas-auth enabled.
Monitor outbound referrers and origins observed on authentication endpoints to detect drive-by CSRF attempts.

How to Mitigate CVE-2026-49871

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0 or later, which contains the fix for the cas-auth plugin.
Inventory all APISIX instances and identify any route or service that enables the cas-auth plugin.
Invalidate active CAS-authenticated sessions after upgrade to evict any sessions established through a forged callback.

Patch Information

Apache has released Apache APISIX 3.17.0 to address CVE-2026-49871. Administrators should review the Apache Security Announcement for upgrade guidance and apply the update across all gateway nodes.

Workarounds

Disable the cas-auth plugin on affected routes until the upgrade to 3.17.0 can be deployed.
Restrict access to APISIX authentication endpoints to known client networks where feasible.
Apply same-site cookie attributes and origin checks at any reverse proxy in front of APISIX to reduce CSRF exposure pending the patch.

bash

# Configuration example: disable cas-auth plugin on a route via the APISIX Admin API
curl -X PATCH http://127.0.0.1:9180/apisix/admin/routes/<route_id> \
  -H 'X-API-KEY: <admin_key>' \
  -d '{
    "plugins": {
      "cas-auth": null
    }
  }'