Apache APISIX CVE-2026-49872

Q: What is the CVSS score of CVE-2026-49872?

CVE-2026-49872 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38026 MEDIUM

Improper Authentication (CWE-287)

2026-06-19 apache

GHSA-cxx6-444w-8847

Authentication Bypass Apache Apache Apisix Apache Software Foundation

5.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-accessible gateway with scope change to backends; PR:L reflects mandatory alternate-source credential possession; C:H/I:H on subsequent systems only, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:27 vuln.today

CVE Published

Jun 19, 2026 - 13:19 cve.org

MEDIUM 5.3

DescriptionCVE.org

Improper Authentication vulnerability in Apache APISIX.

When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

AnalysisAI

Authentication bypass in Apache APISIX 3.0.0 through 3.16.0 allows a network-accessible attacker holding valid credentials from an alternate CAS (Central Authentication Service) source to authenticate against routes protected by the cas-auth plugin, circumventing intended access controls on protected backend APIs. The flaw, rooted in insufficient credential-origin validation within the cas-auth plugin (CWE-287), enables a credential confusion attack across identity sources - potentially granting unauthorized access to downstream systems the gateway is meant to protect. No public exploit code or CISA KEV listing exists at time of analysis; Apache has released version 3.17.0 as the confirmed fix.

Technical ContextAI

Apache APISIX is a cloud-native, high-performance API gateway and management platform built on Nginx and etcd, commonly deployed as a centralized security enforcement point for microservices and API ecosystems. The cas-auth plugin integrates APISIX with the Central Authentication Service (CAS) protocol - a widely used enterprise single sign-on (SSO) standard that issues service tickets tied to specific identity providers and service URLs. CWE-287 (Improper Authentication) identifies the root cause class: the plugin fails to adequately verify that credentials presented during an authentication flow originate from the expected and configured CAS source. In environments with multiple CAS realms, federations, or identity providers, this allows a valid ticket or credential from one CAS source to be accepted by a route expecting another. The affected CPE cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* covers all versions in the 3.0.0-3.16.0 range across platforms.

RemediationAI

The primary fix is upgrading Apache APISIX to version 3.17.0, which corrects the credential-origin validation logic in the cas-auth plugin per the Apache advisory at https://lists.apache.org/thread/bzjpo60ygxo7kxdqf7vw3l5zw2lh6m5k. If an immediate upgrade is not feasible, the most effective compensating control is to disable or remove the cas-auth plugin from all routes until the patch is applied; this eliminates the attack surface but will break CAS-based SSO for affected routes and require teams to implement an alternative authentication mechanism or temporary IP allowlisting as a stopgap - both of which carry operational trade-offs. Prior to patching, teams should audit all route configurations to enumerate every route using cas-auth and assess which backend services are exposed. No workaround short of disabling the plugin is known to close the credential-origin validation gap.