Apache APISIX CVE-2026-47341

Q: What is the CVSS score of CVE-2026-47341?

CVE-2026-47341 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38024 MEDIUM

Authentication Bypass by Capture-replay (CWE-294)

2026-06-19 apache

GHSA-9hp8-p9xx-frx5

Authentication Bypass Apache Apache Apisix Apache Software Foundation

6.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

AT:P configuration prerequisite maps to AC:H in 3.1; scope change reflects gateway authenticating on behalf of downstream backend services.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:25 vuln.today

CVE Published

Jun 19, 2026 - 13:17 cve.org

MEDIUM 6.3

DescriptionCVE.org

Authentication Bypass by Capture-replay vulnerability in Apache APISIX.

Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

HMAC authentication replay in Apache APISIX 3.11.0 through 3.16.0 permits remote attackers who have captured a valid hmac-auth signed token to reuse that token indefinitely, entirely bypassing expiry enforcement under certain plugin configurations. The CVSS 4.0 vector (6.3, AT:P) confirms exploitation depends on a specific hmac-auth configuration condition, limiting blanket exposure but posing significant risk to affected deployments where tokens can be intercepted. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in version 3.17.0 per the Apache security advisory.

Technical ContextAI

Apache APISIX is a cloud-native, high-performance API gateway built on OpenResty/Nginx. Its hmac-auth plugin implements HMAC-based consumer authentication for upstream API protection, generating signed request tokens that are intended to carry temporal validity via expiry fields. CWE-294 (Authentication Bypass by Capture-Replay) describes a root-cause class where authentication credentials are cryptographically valid but lack sufficient replay protection - meaning an intercepted, legitimately-signed token can be resent by an adversary and accepted by the verifier, because the system fails to enforce nonce uniqueness or timestamp expiry under the relevant configuration. The CPE cpe:2.3:a:apache_software_foundation:apache_apisix covers the affected range of 3.11.0 through 3.16.0. The issue is scoped to the hmac-auth plugin subsystem and does not affect other APISIX authentication plugins.

RemediationAI

Vendor-released patch: Apache APISIX 3.17.0, which is the confirmed fix per the Apache security advisory at https://lists.apache.org/thread/ob6ng9x2hxtyfojs839hs1n0v18xxzf2. Administrators should prioritize upgrading to 3.17.0 as the primary remediation. Until upgrade is feasible, review all hmac-auth plugin consumer configurations and verify that clock-skew enforcement and nonce-based replay prevention are explicitly enabled; disabling the expiry-vulnerable configuration path may serve as a partial workaround but requires understanding which specific settings are implicated (consult the advisory thread for details). As a compensating control, temporarily substituting hmac-auth with an alternative short-lived credential mechanism (e.g., key-auth paired with external token rotation) eliminates replay risk but requires consumer reconfiguration. Restricting token transmission to encrypted channels reduces interception opportunities but does not remediate the core replay bypass.