CVE-2026-94276: Apache APISIX Auth Bypass Vulnerability

CVE-2026-94276 Overview

CVE-2026-94276 is an improper authentication vulnerability [CWE-287] in Apache APISIX affecting the openid-connect plugin. The flaw occurs when remote token introspection runs against an authorization server that serves multiple issuers. A token that introspects as active for one issuer may be accepted on a route restricted to a different issuer. The issue affects Apache APISIX versions 3.12.0 through 3.18.0. Version 3.19.0 fixes the vulnerability.

Critical Impact
An authenticated user holding a valid token for one issuer can access routes intended for users of another issuer, breaking cross-issuer isolation on multi-tenant deployments.

Affected Products

Apache APISIX 3.12.0 through 3.18.0
Deployments using the openid-connect plugin with remote introspection
Environments where the authorization server serves multiple issuers

Discovery Timeline

2026-10-01 - CVE-2026-94276 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-94276

Vulnerability Analysis

Apache APISIX is an open-source API gateway that routes and secures HTTP traffic. The openid-connect plugin validates bearer tokens using either local JWT verification or remote introspection against an OAuth 2.0 authorization server. When remote introspection is enabled, APISIX sends the token to the introspection endpoint and relies on the server's active response to authorize the request.

The plugin fails to verify that the token's issuer matches the issuer configured on the specific route. On deployments where a single authorization server issues tokens for multiple tenants or realms, this gap allows cross-tenant access. A token minted for tenant A will introspect as active and will be accepted by a route configured for tenant B.

Root Cause

The root cause is missing issuer binding during the introspection response validation. The plugin treats the active=true field as sufficient proof of authorization. It does not compare the iss claim returned by the introspection endpoint against the issuer configured on the route. This violates OpenID Connect token audience and issuer verification requirements.

Attack Vector

An attacker needs a valid, active token issued by any issuer served by the shared authorization server. The attacker sends an HTTP request to a protected APISIX route configured for a different issuer and includes the token in the Authorization header. The gateway introspects the token, receives an active response, and forwards the request to the upstream service. No exploit code is required beyond a standard HTTP client. Refer to the Apache Mailing List Thread and the Openwall OSS Security Update for technical details.

Detection Methods for CVE-2026-94276

Indicators of Compromise

Successful requests to protected routes where the token iss claim does not match the route's configured issuer
Introspection responses showing active=true for tokens whose issuer differs from the route configuration
Access log entries showing authenticated users reaching upstream services outside their expected tenant scope

Detection Strategies

Enable verbose logging in the openid-connect plugin and capture the iss claim from each introspected token
Correlate route identifiers with the issuer value on each authenticated request to detect mismatches
Review audit logs for cross-tenant access patterns where a single subject accesses resources belonging to multiple issuers

Monitoring Recommendations

Forward APISIX access and plugin logs to a centralized logging system for issuer-to-route correlation analysis
Alert when the ratio of distinct issuers per authenticated subject exceeds expected tenant boundaries
Monitor authorization server introspection traffic for tokens being validated against unexpected routes

How to Mitigate CVE-2026-94276

Immediate Actions Required

Upgrade Apache APISIX to version 3.19.0, which contains the fix
Inventory all routes using the openid-connect plugin with bearer_only or introspection enabled
Audit authorization server configuration to identify shared introspection endpoints serving multiple issuers

Patch Information

The Apache APISIX project released version 3.19.0 to address CVE-2026-94276. The fix enforces issuer validation during remote token introspection so that the iss claim must match the issuer configured on the route. Users on affected versions 3.12.0 through 3.18.0 should upgrade immediately. See the Apache Mailing List Thread for release details.

Workarounds

Configure dedicated introspection endpoints per issuer so each route only validates tokens from its intended authorization server
Switch affected routes to local JWT verification with strict iss and aud claim validation until the upgrade is applied
Restrict route-level access using additional APISIX plugins such as consumer-restriction to enforce tenant boundaries

bash

# Configuration example: upgrade and verify version
helm upgrade apisix apisix/apisix --version 3.19.0
kubectl exec -it <apisix-pod> -- apisix version