CVE-2026-94212: Apache APISIX Auth Bypass Vulnerability

CVE-2026-94212 Overview

CVE-2026-94212 is an improper verification of cryptographic signature vulnerability [CWE-347] in Apache APISIX. The flaw affects the saml-auth plugin under default configuration. An unauthenticated remote attacker can impersonate any user on any route protected by the plugin. The issue impacts Apache APISIX versions 3.17.0 through 3.18.0. The Apache APISIX project released version 3.19.0 to fix the vulnerability.

Critical Impact

Unauthenticated attackers can impersonate arbitrary users on every route protected by the saml-auth plugin, bypassing SAML-based authentication and authorization controls.

Affected Products

• Apache APISIX 3.17.0
• Apache APISIX 3.18.0
• Apache APISIX deployments using the saml-auth plugin under default configuration

Discovery Timeline

• 2026-10-01 - CVE CVE-2026-94212 published to NVD
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-94212

Vulnerability Analysis

Apache APISIX is an open-source API gateway that routes and secures traffic between clients and upstream services. The saml-auth plugin lets operators enforce Security Assertion Markup Language (SAML) authentication at the gateway. CVE-2026-94212 breaks the trust model of that plugin.

The plugin fails to properly verify the cryptographic signature on SAML assertions under the default configuration. An attacker can submit a forged or unsigned SAML response and have the gateway treat it as a valid identity assertion. The gateway then provisions a session for the impersonated principal and forwards the request upstream.

Because SAML assertions typically carry the authenticated subject and group claims, the attacker inherits whatever privileges the impersonated user holds on protected routes. This bypasses both authentication and any downstream authorization that trusts the gateway-provided identity.

Root Cause

The root cause is improper verification of cryptographic signatures on SAML assertions [CWE-347]. The default configuration does not enforce strict signature validation on inbound SAML responses, so the plugin accepts assertions whose signatures are missing, malformed, or signed by an untrusted key.

Attack Vector

Exploitation is network-based and requires no prior authentication. An attacker sends a crafted SAML response to a route protected by the saml-auth plugin, setting the NameID or subject attribute to the target user. The gateway accepts the assertion and treats subsequent requests as that user. No user interaction is required.

No verified public proof-of-concept code is available at this time. See the Apache Mailing List Thread and the Openwall OSS Security Update for upstream technical details.

Detection Methods for CVE-2026-94212

Indicators of Compromise

• SAML AuthnResponse messages received by APISIX with missing, malformed, or unsigned <ds:Signature> elements.
• Successful logins through the saml-auth plugin that do not correlate with authentication events at the configured identity provider (IdP).
• Session or audit logs showing requests attributed to privileged users originating from unexpected IP addresses or user agents.

Detection Strategies

• Compare APISIX access logs against IdP authentication logs and alert on gateway sessions that lack a matching IdP assertion issuance event.
• Parse captured SAML responses at the gateway and flag assertions where the signature reference, digest, or issuer certificate fails independent validation.
• Baseline the APISIX version in use across environments and alert when any node is running a release between 3.17.0 and 3.18.0.

Monitoring Recommendations

• Enable verbose logging on the saml-auth plugin to capture raw SAML payloads for post-hoc verification.
• Forward APISIX gateway logs and IdP logs to a centralized analytics platform for cross-source correlation.
• Monitor for sudden spikes in SAML authentications or sessions created for high-privilege accounts across routes protected by the plugin.

How to Mitigate CVE-2026-94212

Immediate Actions Required

• Upgrade Apache APISIX to version 3.19.0, which contains the fix for CVE-2026-94212.
• Inventory all routes that reference the saml-auth plugin and prioritize patching gateways that front sensitive upstream services.
• Rotate any session tokens or API keys that may have been issued through the affected plugin during the exposure window.

Patch Information

The Apache APISIX project resolved CVE-2026-94212 in version 3.19.0. Operators running 3.17.0 or 3.18.0 must upgrade to 3.19.0 or later. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

• If immediate upgrade is not feasible, disable the saml-auth plugin and enforce authentication through an alternate mechanism such as jwt-auth or key-auth.
• Place a hardened SAML service provider in front of APISIX and terminate SAML at that service provider instead of the gateway.
• Restrict network access to APISIX routes protected by saml-auth to known client IP ranges until patching is complete.

# Configuration example: disable the saml-auth plugin until upgrade is complete
# /usr/local/apisix/conf/config.yaml
plugins:
  # - saml-auth   # disabled: see CVE-2026-94212
  - jwt-auth
  - key-auth
  - ip-restriction