CVE Intelligence
Analysis AI-assisted

CVE-2026-49230: Apache APISIX jwe-decrypt Authentication Bypass via Integrity Check Validation

CVE-2026-49230 affects the jwe-decrypt plugin of Apache APISIX under its default configuration, where improper validation of an integrity check value can allow authentication bypass. The description states that versions from 3.8.0 through 3.16.0 are affected and that upgrading to 3.17.0 fixes the issue. NVD rates it 9.1 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-49230 is an improper validation of integrity check value issue (CWE-354) in Apache APISIX. According to the record, the jwe-decrypt plugin is vulnerable to authentication bypass under its default configuration.

Impact

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable issue with low complexity that requires no privileges or user interaction, with high confidentiality and integrity impact and no availability impact. The real impact on a given deployment depends on how the plugin is used.

Affected products and versions

  • Apache APISIX, from 3.8.0 through 3.16.0 according to the description.
  • The structured affected range is 3.8.0 or later and before 3.17.0.

The record does not list any other affected products.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. No EPSS data is available.

Remediation and mitigation

  • Upgrade Apache APISIX to version 3.17.0, which the description states fixes the issue.
  • Prioritize instances where the jwe-decrypt plugin is enabled.
  • Review whether the plugin is required. Where it is not, consider disabling it until the upgrade is applied. This is an inference from the available data, not a vendor recommendation.

See the Apache mailing list thread and the oss-security post.

Detection guidance

  • Inventory APISIX deployments and identify whether the jwe-decrypt plugin is enabled on any route or service.
  • Review authentication logs for those routes for unexpected successful requests or unusual access patterns, at a high level.
  • After upgrading, verify that the running version is 3.17.0 or later.

Limitations of the available information

The record does not describe the technical mechanics of the bypass, the exact conditions required, or detection signatures. The structured fixed-version field is empty, so the 3.17.0 fix relies on the description and linked advisories. The CNA provided a CVSS 4.0 score of 6.3, while NVD's score of 9.1 uses CVSS 3.1; the record does not explain the difference.

Frequently asked questions

What is CVE-2026-49230?

It is an improper validation of integrity check value issue (CWE-354) in the jwe-decrypt plugin of Apache APISIX that, according to the record, allows authentication bypass under default configuration.

Which versions are affected?

The description states versions from 3.8.0 through 3.16.0 are affected, and the structured range is 3.8.0 or later and before 3.17.0.

What should administrators do?

Upgrade Apache APISIX to version 3.17.0, which the description says fixes the issue, and prioritize instances where the jwe-decrypt plugin is enabled.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.