CVE-2026-92790: Higress Auth Bypass Vulnerability

CVE-2026-92790 Overview

Higress versions before 2.2.4 contain a flaw in the AI token rate-limiting plugin that allows unauthenticated attackers to bypass rate limits. The plugin panics when it processes a Cookie header segment that lacks an equals sign. The plugin wrapper recovers from the panic and returns a continue action, which skips the rate-limit check entirely. Attackers can send malformed Cookie headers to exceed thresholds designed to constrain costly model backend calls. This exposes AI gateway operators to elevated inference costs and abuse of protected model endpoints.

Critical Impact
Unauthenticated network attackers can bypass AI token rate limiting by sending a single malformed Cookie header, driving unbounded requests to backend model providers.

Affected Products

Higress AI gateway versions prior to 2.2.4
Higress wasm-goai-token-ratelimit extension
Deployments exposing the affected plugin to untrusted clients

Discovery Timeline

2026-09-16 - CVE-2026-92790 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92790

Vulnerability Analysis

Higress is an open-source cloud-native API gateway that includes WebAssembly (WASM) plugins for AI traffic governance. The ai-token-ratelimit plugin inspects request headers to attribute usage and enforce per-client token quotas against large language model backends. During cookie parsing in plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go, the plugin splits Cookie header values on the ; delimiter and expects each segment to contain a key=value pair.

When a segment does not contain an = character, the parsing routine triggers an unrecovered index or slicing operation that causes a Go panic. The surrounding plugin wrapper catches the panic and returns a continue action, which is the safe default for plugin failures. That default allows the request to proceed without executing the remaining rate-limit logic. The behavior maps to [CWE-703: Improper Check or Handling of Exceptional Conditions].

Root Cause

The root cause is missing input validation on individual Cookie header segments before they are parsed as key-value pairs. Combined with fail-open behavior in the WASM plugin wrapper, any parser panic converts into a rate-limit bypass rather than a denied request.

Attack Vector

An unauthenticated attacker sends HTTP requests through the Higress gateway with a Cookie header containing a segment without an = sign, for example Cookie: validkey=value; malformed. The plugin panics, the wrapper recovers, and the request is forwarded to the AI backend without token accounting. Repeating this pattern lets the attacker exceed configured quotas and drive traffic to paid model APIs. Refer to the VulnCheck Higress Advisory and Higress GitHub Issue #4599 for technical details.

Detection Methods for CVE-2026-92790

Indicators of Compromise

Inbound requests containing Cookie header segments without an = character (for example, tokens after ; that are bare words).
Gateway logs showing plugin panic-recovery events originating from ai-token-ratelimit in Higress versions < 2.2.4.
Sustained request volume to AI backends from a single client without corresponding rate-limit decrements.

Detection Strategies

Parse gateway access logs and flag requests whose Cookie header contains any segment lacking =, especially from unauthenticated sources.
Correlate WASM plugin error and panic-recovery telemetry against backend model usage metrics to identify bypass patterns.
Compare per-client observed token consumption to configured rate-limit thresholds; investigate any client that exceeds thresholds without being throttled.

Monitoring Recommendations

Enable verbose logging for the ai-token-ratelimit plugin and forward events to a centralized log platform.
Alert on sudden increases in AI backend token spend or request rate that are not explained by legitimate traffic growth.
Track Higress version inventory and flag any node still running a release earlier than 2.2.4.

How to Mitigate CVE-2026-92790

Immediate Actions Required

Upgrade all Higress instances to version 2.2.4 or later, which corrects cookie segment parsing in utils.go.
Audit gateway configurations to confirm the ai-token-ratelimit plugin is enabled on every route that reaches AI model backends.
Review recent backend model billing and usage records for anomalies consistent with rate-limit bypass.

Patch Information

The fix is included in Higress 2.2.4. The change is visible by comparing the vulnerable code in v2.2.3 with the patched code in v2.2.4. Additional context is available in the Higress GitHub Repository.

Workarounds

Deploy an upstream filter or WAF rule that rejects requests whose Cookie header contains segments without an = sign.
Enforce provider-side quotas or API key limits on the AI backend so that gateway bypass does not translate directly into unbounded spend.
Restrict access to AI routes with authentication or network controls until the upgrade is applied.

bash

# Example WAF/nginx snippet to block malformed Cookie segments
if ($http_cookie ~* "(^|;)\s*[^=;]+(;|$)") {
    return 400;
}