Apache APISIX CVE-2026-47339

Q: What is the CVSS score of CVE-2026-47339?

CVE-2026-47339 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38015 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-19 apache

GHSA-2455-m68h-qwxv

Authentication Bypass Apache Apache Apisix Apache Software Foundation

5.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-reachable via default plugin config; low privileges (credentials required); scope changes to high-value backend APIs with full C/I impact but no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:22 vuln.today

CVE Published

Jun 19, 2026 - 13:10 cve.org

MEDIUM 5.3

DescriptionCVE.org

Incorrect Authorization vulnerability in Apache APISIX.

An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

Incorrect authorization in the Apache APISIX authz-casdoor plugin allows a network-authenticated attacker to cross-authenticate using credentials from a different identity source, effectively bypassing the intended authorization boundary. Affected versions span 2.14.1 through 3.16.0, covering a wide deployment surface for this popular open-source API gateway. The CVSS 4.0 vector signals no direct impact to APISIX itself but high confidentiality and integrity impact on subsequent systems - the upstream APIs and services the gateway is meant to protect. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache APISIX is a high-performance, cloud-native API gateway built on OpenResty and Nginx. Its plugin architecture allows modular authentication and authorization providers; the authz-casdoor plugin integrates with Casdoor, an open-source identity and access management platform implementing OAuth 2.0 and OIDC. CWE-863 (Incorrect Authorization) indicates the flaw is not in credential validation per se but in how APISIX evaluates whether a successfully-authenticated principal is permitted to act - specifically, it fails to enforce that credentials must originate from the expected, configured identity source. Under default plugin configuration, credential provenance is not adequately enforced, enabling a credential-confusion attack where tokens or credentials from a different source pass authorization checks. The CPE cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* confirms the flaw is in the core APISIX application package itself, not a third-party dependency.

RemediationAI

The primary and strongly recommended fix is to upgrade Apache APISIX to version 3.17.0, which the Apache Software Foundation has confirmed resolves the incorrect authorization logic in the authz-casdoor plugin. Details are available in the vendor advisory at https://lists.apache.org/thread/lk4q5o855cocc7zq5wh1zlctfmcq6f76. If an immediate upgrade is not feasible, the most effective compensating control is to disable the authz-casdoor plugin entirely and substitute an alternative authorization plugin (e.g., authz-keycloak or openid-connect with strict issuer validation), though this requires reconfiguring authentication flows and may require changes to downstream Casdoor integration. If disabling the plugin is not operationally possible, restrict access to the APISIX admin API and route endpoints to trusted networks only, reducing the attacker pool who can supply alternative credentials. Note that network-layer restrictions alone do not fix the underlying authorization logic flaw and should be treated as temporary mitigations only.