SB2026082576 - Multiple vulnerabilities in Apache APISIX

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082576

SB2026082576 - Multiple vulnerabilities in Apache APISIX

Published: August 25, 2026

Security Bulletin ID SB2026082576
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 13% Medium 75% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Open redirect (CVE-ID: CVE-2026-44915)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to open redirect in the cas-auth plugin when processing an unsanitized cookie value. A remote attacker can supply a crafted cookie value to redirect users to an untrusted site.

The default configuration of the cas-auth plugin is vulnerable, which may enable phishing and credential theft.


2) Incorrect authorization (CVE-ID: CVE-2026-47339)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to authenticate themselves with credentials from a different source.

The vulnerability exists due to improper authorization in the authz-casdoor plugin when operating under the default configuration. A remote attacker can exploit the plugin behavior to authenticate themselves with credentials from a different source.

Only deployments using the authz-casdoor plugin under the default configuration are vulnerable.


3) Improper Authentication (CVE-ID: CVE-2026-47341)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in hmac-auth when validating HMAC-authenticated requests under certain configurations. A remote attacker can replay a captured token to bypass authentication.

The issue allows token reuse without expiry enforcement under affected configurations.


4) Improper Authentication (CVE-ID: CVE-2026-49872)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in the cas-auth plugin when the plugin is used in a route. A remote attacker can authenticate with credentials from a different source to bypass authentication.


5) Cross-site request forgery (CVE-ID: CVE-2026-49871)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause actions taken by the victim upstream to be attributed to the attacker's identity.

The vulnerability exists due to cross-site request forgery in the cas-auth plugin when handling login requests under default configurations. A remote attacker can send the victim to a webpage controlled by them to cause actions taken by the victim upstream to be attributed to the attacker's identity.

The victim's browser can become authenticated as a different identity.


6) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-49231)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to assume higher privileges on the upstream service.

The vulnerability exists due to improper access control in opa plugin when relaying spoofed identity headers to upstream services. A remote attacker can send spoofed identity headers to assume higher privileges on the upstream service.

Exploitation requires non-default configuration in the plugin.


7) Improper validation of integrity check value (CVE-ID: CVE-2026-49230)

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper validation of integrity check value in the jwe-decrypt plugin when processing JWE tokens under the default configuration. A remote attacker can supply a crafted JWE token to bypass authentication.

Only the jwe-decrypt plugin under the default configuration is vulnerable.


8) Open redirect (CVE-ID: CVE-2026-48895)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to an open redirect in the cas-auth component when processing manipulated client headers. A remote attacker can manipulate client headers to redirect users to an untrusted site.

The issue could potentially expose a session token.


Remediation

Install update from vendor's website.

References