CVE-2026-82806: Apache APISIX Auth Bypass Vulnerability

CVE-2026-82806 Overview

CVE-2026-82806 is an authorization scope leakage vulnerability in Apache APISIX, an open-source API gateway. The flaw affects versions from 2.3.0 before 3.7.0 when the authz-keycloak plugin is configured. A request's authorization scope can persist into later requests on the same route, causing unintended authorization expansion and inconsistent access-control decisions. The issue is categorized under CWE-488: Exposure of Data Element to Wrong Session. Apache has released version 3.7.0 to remediate the vulnerability.

Critical Impact

Authorization scopes from prior requests can leak into subsequent requests on the same route, allowing authenticated users to perform actions beyond their intended privileges.

Affected Products

• Apache APISIX 2.3.0 through 3.6.x
• Deployments using the authz-keycloak plugin
• API gateways relying on Keycloak-based scope enforcement

Discovery Timeline

• 2026-10-01 - CVE CVE-2026-82806 published to NVD
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-82806

Vulnerability Analysis

Apache APISIX routes requests through plugin chains that evaluate authentication and authorization decisions per request. The authz-keycloak plugin integrates with Keycloak to enforce fine-grained authorization scopes using User-Managed Access (UMA) semantics. In affected releases, scope state computed for one request is not fully isolated from later requests served by the same route.

The result is that an authorization decision made for user A, or for a specific scope, can influence the decision made for a subsequent request from user B on the same route. This weakens the per-request authorization guarantee that API gateway operators expect. Downstream services that trust the gateway's enforcement may serve data to callers who should have been denied.

Root Cause

The root cause falls under CWE-488, where a data element intended for one session persists into another. In the authz-keycloak code path, authorization scope data is stored in a location that is reused across requests on the same route rather than being bound to the individual request context. This produces non-deterministic access-control outcomes depending on request ordering and plugin cache behavior.

Attack Vector

The vulnerability is exploitable over the network against any route protected by the authz-keycloak plugin on a vulnerable APISIX version. An authenticated low-privileged user can issue requests whose scope state later contaminates evaluations for other requests on the same route. See the Apache mailing list advisory and the OpenWall oss-security discussion for additional context.

No verified public exploit code is available at the time of publication, so this article describes the mechanism in prose rather than providing proof-of-concept code.

Detection Methods for CVE-2026-82806

Indicators of Compromise

• Access-control audit log entries in Keycloak showing scope grants that do not match the authenticated principal on the APISIX request.
• Backend application logs recording successful access to resources that should have been denied for the authenticated user.
• Discrepancies between APISIX plugin logs and upstream service authorization logs for the same request identifier.

Detection Strategies

• Inventory all APISIX routes that reference the authz-keycloak plugin and confirm the running APISIX version against the 2.3.0 to 3.7.0 range.
• Replay historical traffic in a staging environment with per-request scope assertions to detect scope bleed across sequential requests on the same route.
• Correlate gateway decisions with Keycloak token introspection results to identify authorization decisions that diverge from the token's actual scopes.

Monitoring Recommendations

• Enable verbose logging for the authz-keycloak plugin and forward logs to a centralized analytics platform for cross-request correlation.
• Alert on anomalous spikes in 2xx responses from endpoints that historically returned 403 for specific user roles.
• Monitor for repeated requests from the same client against sensitive routes that could trigger scope persistence conditions.

How to Mitigate CVE-2026-82806

Immediate Actions Required

• Upgrade Apache APISIX to version 3.7.0 or later on all gateway nodes.
• Audit all routes using the authz-keycloak plugin and review recent access logs for unexpected authorization grants.
• Rotate any credentials or tokens that may have been used to access resources beyond their intended scope during the exposure window.

Patch Information

Apache has released APISIX 3.7.0, which fixes the scope persistence defect in the authz-keycloak plugin. The upgrade is the vendor-recommended remediation. Review the Apache mailing list advisory for release notes and upgrade guidance before deploying to production.

Workarounds

• Disable the authz-keycloak plugin on affected routes until the upgrade to 3.7.0 is completed, substituting an alternative authorization plugin where feasible.
• Enforce defense-in-depth by validating authorization at the upstream service using the original Keycloak access token rather than relying solely on gateway-side scope decisions.
• Restrict access to sensitive routes to trusted network segments while remediation is in progress.

# Verify the running Apache APISIX version
apisix version

# Upgrade using the official Helm chart (example)
helm repo update
helm upgrade apisix apisix/apisix --version 3.7.0 -n apisix

# Confirm the authz-keycloak plugin configuration after upgrade
curl http://127.0.0.1:9180/apisix/admin/routes \
  -H "X-API-KEY: $ADMIN_KEY" | jq '.list[] | select(.value.plugins["authz-keycloak"])'