{"id":"CVE-2026-124679","kind":"vulnerability","aliases":["CVE-2026-124679"],"related":[],"title":"Apache APISIX: spoofed headers let unauthenticated requests bypass gateway authentication","description":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn routes using jwe-decrypt with strict: false and a\nforward_header distinct from the token header an unauthenticated\nclient can supply the value the upstream treats as gateway-decrypted\nplaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.\n\n\n\nThis issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue.","summary":"On routes using jwe-decrypt with strict set to false and a forward_header different from the token header, an unauthenticated client can supply the value the upstream treats as decrypted plaintext. A similar bypass exists when forward-auth runs with allow_degradation set to true and the auth service is unavailable.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-apisix","api-gateway","infrastructure","kubernetes","self-hosted"],"not_affected_if":["auth-required","default-config","outside-3.18-3.19"],"how_to_check":"- Look for `jwe-decrypt` or `forward-auth` in APISIX route and plugin configuration.\n- Check whether `strict` is set to `false` on `jwe-decrypt` routes.\n- Check whether `allow_degradation` is set to `true` on `forward-auth`.\n- Check the installed APISIX version with `apisix version`; affected versions are from 3.18.0 through 3.19.0.","fix":"- Apache APISIX: upgrade to `3.20.0`.","status":"open","published_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","triaged_at":"2026-11-13T18:51:28+00:00","updated_at":"2026-11-13T18:51:28+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T18:51:28Z","model":"claude-haiku-5-5","output":{"fix":"- Apache APISIX: upgrade to `3.20.0`.","reach":"internet","title":"Apache APISIX: spoofed headers let unauthenticated requests bypass gateway authentication","impact":"high","summary":"On routes using jwe-decrypt with strict set to false and a forward_header different from the token header, an unauthenticated client can supply the value the upstream treats as decrypted plaintext. A similar bypass exists when forward-auth runs with allow_degradation set to true and the auth service is unavailable.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["apache-apisix","api-gateway","self-hosted","kubernetes"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated requests reach upstream services as if authenticated","analyst_note":"","how_to_check":"- Look for `jwe-decrypt` or `forward-auth` in APISIX route and plugin configuration.\n- Check whether `strict` is set to `false` on `jwe-decrypt` routes.\n- Check whether `allow_degradation` is set to `true` on `forward-auth`.\n- Check the installed APISIX version with `apisix version`; affected versions are from 3.18.0 through 3.19.0.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","auth-required","outside-3.18-3.19"],"who_is_affected":"Deployments of Apache APISIX from 3.18.0 through 3.19.0 that use the jwe-decrypt plugin with strict set to false and a forward_header distinct from the token header, or forward-auth with allow_degradation enabled while the auth service is down. Routes without these plugin settings are not exposed through this path. Teams on other APISIX versions, or without these settings, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000795,"input_tokens":4628,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124679':13A,16A '-2026':12A,15A '3.18.0':148C '3.19.0':150C '3.20.0':158C 'affect':144C 'allow':71B,133C 'apach':1A,18B,88C,145C 'apache-apisix':17B 'api':21B 'api-gateway':20B 'apisix':2A,19B,89C,146C 'auth':68B,78B,129C,138C 'authent':10A,82C 'bypass':8A,63B,83C 'client':50B,110C 'configur':131C 'cve':11A,14A 'decrypt':33B,59B,95C,121C 'degrad':72B,134C 'differ':43B 'distinct':103C 'exist':64B 'fals':38B,98C 'fix':160C 'forward':41B,67B,101C,128C 'forward-auth':66B,127C 'gateway':9A,22B,120C 'gateway-decrypt':119C 'happen':125C 'header':4A,42B,47B,102C,107C 'host':27B 'infrastructur':23B 'issu':143C,162C 'jwe':32B,94C 'jwe-decrypt':31B,93C 'kubernet':24B 'let':5A 'plaintext':60B,122C 'recommend':153C 'request':7A 'rout':29B,91C 'run':69B 'self':26B 'self-host':25B 'servic':79B,139C 'set':36B,73B 'similar':62B,123C 'spoof':3A,85C 'strict':35B,97C 'suppli':52B,112C 'token':46B,106C 'treat':57B,117C 'true':75B,135C 'unauthent':6A,49B,109C 'unavail':81B,141C 'upgrad':155C 'upstream':56B,116C 'use':30B,92C 'user':151C 'valu':54B,114C 'version':157C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache APISIX from 3.18.0 through 3.19.0 that use the jwe-decrypt plugin with strict set to false and a forward_header distinct from the token header, or forward-auth with allow_degradation enabled while the auth service is down. Routes without these plugin settings are not exposed through this path. Teams on other APISIX versions, or without these settings, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheapisix","apigateway","high","infrastructure","kubernetes","selfhosted"],"campaign_type":null,"search_a":"'-124679':13A,16A '-2026':12A,15A 'apach':1A 'apisix':2A 'authent':10A 'bypass':8A 'cve':11A,14A 'gateway':9A 'header':4A 'let':5A 'request':7A 'spoof':3A 'unauthent':6A","search_b":"'allow':71B 'apach':18B 'apache-apisix':17B 'api':21B 'api-gateway':20B 'apisix':19B 'auth':68B,78B 'bypass':63B 'client':50B 'decrypt':33B,59B 'degrad':72B 'differ':43B 'exist':64B 'fals':38B 'forward':41B,67B 'forward-auth':66B 'gateway':22B 'header':42B,47B 'host':27B 'infrastructur':23B 'jwe':32B 'jwe-decrypt':31B 'kubernet':24B 'plaintext':60B 'rout':29B 'run':69B 'self':26B 'self-host':25B 'servic':79B 'set':36B,73B 'similar':62B 'strict':35B 'suppli':52B 'token':46B 'treat':57B 'true':75B 'unauthent':49B 'unavail':81B 'upstream':56B 'use':30B 'valu':54B","search_c":"'3.18.0':148C '3.19.0':150C '3.20.0':158C 'affect':144C 'allow':133C 'apach':88C,145C 'apisix':89C,146C 'auth':129C,138C 'authent':82C 'bypass':83C 'client':110C 'configur':131C 'decrypt':95C,121C 'degrad':134C 'distinct':103C 'fals':98C 'fix':160C 'forward':101C,128C 'forward-auth':127C 'gateway':120C 'gateway-decrypt':119C 'happen':125C 'header':102C,107C 'issu':143C,162C 'jwe':94C 'jwe-decrypt':93C 'plaintext':122C 'recommend':153C 'rout':91C 'servic':139C 'similar':123C 'spoof':85C 'strict':97C 'suppli':112C 'token':106C 'treat':117C 'true':135C 'unauthent':109C 'unavail':141C 'upgrad':155C 'upstream':116C 'use':92C 'user':151C 'valu':114C 'version':157C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124679","severity":null,"published_at":"2026-11-13T18:17:31+00:00","modified_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","fetched_at":"2026-11-13T18:49:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}