CVE-2026-49871: Apache APISIX cas-auth Plugin CSRF Vulnerability
A Cross-Site Request Forgery flaw in the cas-auth plugin of Apache APISIX under default configurations may let a remote attacker lead a victim's browser into an authenticated state tied to a different identity. The record reports a CVSS 3.1 base score of 9.3 from NVD and a fix in version 3.17.0. The sources consulted show no KEV listing and no confirmed exploitation.
Overview
CVE-2026-49871 is a Cross-Site Request Forgery (CSRF) weakness, classified as CWE-352, in the cas-auth plugin of Apache APISIX. According to the CVE record, the issue exists under default configurations and can be triggered when a logged-in victim is sent to a web page controlled by an attacker. The CNA is security@apache.org and the record was published on 2026-06-19.
Impact
The record states that the victim's browser can become authenticated as a different identity, so actions the victim performs upstream are attributed to the attacker's identity. NVD assigns a CVSS 3.1 base score of 9.3 (critical), with high confidentiality and integrity impact and no availability impact, and requires user interaction. The CNA reports a CVSS 4.0 score of 2.1, so the two scores differ in severity assessment.
Affected products and versions
- Product: Apache APISIX, cas-auth plugin.
- Affected range in the record: 3.0.0 through 3.16.0, expressed as greater than or equal to 3.0.0 and less than 3.17.0.
- Fixed version: 3.17.0, according to the CVE description. The structured fixes field in the record is empty, so the fix version is taken from the description text.
Exploitation status
The KEV catalog entry is not listed for this CVE, and no exploitation data is available in the record. No confirmed exploitation appears in the sources consulted. The EPSS and SSVC fields are empty.
Remediation and mitigation
- Identify every Apache APISIX deployment within the affected range and confirm whether the cas-auth plugin is enabled.
- Upgrade to version 3.17.0 or later, as recommended in the vendor advisory and the CVE description.
- Review the official Apache mailing list thread and the oss-security post for vendor guidance and any additional steps.
- If an immediate upgrade is not possible, limit exposure of administrative and authenticated routes and monitor for unexpected authentication changes. This is an inference and not a vendor-confirmed workaround.
Detection guidance
- Review authentication logs for sessions that change identity without a corresponding login by the user.
- Look for user-initiated state-changing actions that originate from unexpected external referrers or that the user does not recognize.
- Track which hosts run APISIX versions 3.0.0 through 3.16.0 so that remediation can be verified after the upgrade.
Limitations of the available information
The sources do not describe the exact conditions required beyond default configuration, the attack prerequisites in detail, or the specific endpoints affected. The sources consulted do not include a vendor-published proof of concept or exploitation telemetry. The disagreement between the NVD CVSS 3.1 score and the CNA CVSS 4.0 score is not explained in the record.
Frequently asked questions
Which Apache APISIX versions are affected by CVE-2026-49871?
The record lists versions from 3.0.0 through 3.16.0, expressed as greater than or equal to 3.0.0 and less than 3.17.0.
Is there a fix for this vulnerability?
The CVE description recommends upgrading to version 3.17.0, which fixes the issue. The structured fixes field in the record is empty.
Is this vulnerability being actively exploited?
It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.