CVE-2026-49872: Apache APISIX Auth Bypass Vulnerability

CVE-2026-49872 Overview

CVE-2026-49872 is an Improper Authentication vulnerability [CWE-287] in Apache APISIX, an open-source API gateway. The flaw resides in the cas-auth plugin, which integrates Central Authentication Service (CAS) single sign-on into protected routes. When the plugin is configured on a route, an attacker can authenticate using credentials issued by a different CAS source than the one intended by the route owner. The issue affects Apache APISIX versions 3.0.0 through 3.16.0. The Apache APISIX project recommends upgrading to version 3.17.0, which contains the fix.

Critical Impact
An attacker holding valid credentials from any accepted CAS source can authenticate to routes that should only trust a specific identity provider, bypassing intended access controls.

Affected Products

Apache APISIX 3.0.0 through 3.16.0
Routes configured with the cas-auth plugin
Deployments relying on CAS single sign-on for API gateway authentication

Discovery Timeline

2026-06-19 - CVE-2026-49872 published to the National Vulnerability Database
2026-06-19 - Advisory posted to the Apache mailing list and OpenWall oss-security
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49872

Vulnerability Analysis

Apache APISIX exposes the cas-auth plugin to allow operators to bind a route to a CAS identity provider. The plugin is expected to validate that any ticket or session presented by a client originates from the CAS source declared in the route configuration. In affected versions, this binding between the route and the trusted CAS source is not strictly enforced during authentication. An attacker can present credentials obtained from a different CAS source and the plugin still treats the request as authenticated. This breaks the trust boundary that operators assume when isolating routes by identity provider, and enables horizontal access to APIs intended for a separate user population.

Root Cause

The root cause is improper authentication logic in the cas-auth plugin [CWE-287]. The plugin accepts authentication state without correctly verifying that the issuing CAS source matches the source configured on the targeted route. Tying authentication validity to ticket presence rather than ticket origin allows credentials from unrelated CAS deployments to satisfy the check.

Attack Vector

Exploitation requires network access to an APISIX route protected by the cas-auth plugin and valid credentials at a CAS source the gateway accepts elsewhere in its configuration. The attacker authenticates against that secondary CAS source, then replays or reuses the resulting session against the targeted route. No special privileges on the gateway are required beyond holding any accepted CAS identity. The vulnerability does not directly disclose data or allow code execution, but it grants unauthorized access to upstream APIs gated by the affected route.

No public proof-of-concept exploit is available at the time of publication. Refer to the Apache Mailing List Discussion and OpenWall OSS Security Update for vendor technical detail.

Detection Methods for CVE-2026-49872

Indicators of Compromise

Successful authentication events on cas-auth protected routes where the originating CAS ticket issuer does not match the route's configured CAS server URL.
Access log entries showing requests to APISIX routes from user principals that should not exist in the route's expected identity population.
Unexpected upstream API calls following CAS authentication redirects that terminate at a non-canonical CAS endpoint.

Detection Strategies

Audit APISIX route definitions and correlate the cas-auth plugin's configured CAS server against the issuer field of accepted tickets recorded in access logs.
Compare authenticated user identifiers against the expected directory of users for each protected route and alert on principals outside that set.
Review gateway error and debug logs for CAS validation responses that reference unexpected serviceValidate endpoints.

Monitoring Recommendations

Forward APISIX access and error logs to a centralized logging platform and build alerts on cross-tenant authentication anomalies.
Track upstream API request volumes per authenticated principal to detect access from identities that did not previously interact with the route.
Monitor for the running APISIX version across the fleet and alert when any instance reports a build between 3.0.0 and 3.16.0.

How to Mitigate CVE-2026-49872

Immediate Actions Required

Upgrade Apache APISIX to version 3.17.0 or later on every gateway node.
Inventory all routes that reference the cas-auth plugin and treat them as exposed until the upgrade is verified.
Rotate any session material or downstream API tokens that may have been issued through cas-auth during the exposure window.

Patch Information

Apache APISIX 3.17.0 contains the fix for CVE-2026-49872. Operators running versions 3.0.0 through 3.16.0 must upgrade. The vendor advisory is available on the Apache Mailing List Discussion and the OpenWall OSS Security Update.

Workarounds

Temporarily disable the cas-auth plugin on affected routes and substitute another authentication plugin such as jwt-auth or key-auth until the upgrade is complete.
Restrict network exposure of cas-auth protected routes to trusted client networks using IP allow-lists at the gateway or upstream firewall.
Configure only a single trusted CAS server per APISIX deployment to reduce the population of credentials that satisfy the broken check.

bash

# Verify the installed Apache APISIX version and upgrade
apisix version

# Example upgrade via Helm chart
helm repo update
helm upgrade apisix apisix/apisix --version 3.17.0 -n apisix

# Verify the cas-auth plugin is loaded only where required
curl http://127.0.0.1:9180/apisix/admin/routes \
  -H "X-API-KEY: $ADMIN_KEY" | jq '.list[] | select(.value.plugins["cas-auth"])'