CVE-2026-49230 is a critical (CVSS 9.1) authentication bypass in the jwe-decrypt plugin of Apache APISIX, versions 3.8.0 through 3.16.0. Under default configuration the plugin does not validate an integrity check value properly. Upgrade to APISIX 3.17.0, which the Apache project says fixes the issue.
What's affected
- Product: Apache APISIX, the open source API gateway.
- Affected: 3.8.0 through 3.16.0, in the jwe-decrypt plugin under default configuration.
- Fixed: 3.17.0, as stated in the CVE record.
- Weakness: CWE-354, improper validation of integrity check value.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. - Published 19 June 2026. Not marked as exploited in CISA KEV.
How to check if you're exposed
apisix version
If you run the container image, check the image tag in your deployment manifests instead:
docker ps --format '{.Image}' | grep -i apisix
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i apisix
Then confirm whether the plugin is enabled in your configuration. Search your config.yaml and your route and plugin definitions for jwe-decrypt. Only routes that use the plugin are in scope, but upgrading is still the right fix.
What to do now
- Upgrade APISIX to 3.17.0 or later and redeploy every gateway node.
- List every route, service and consumer that uses the jwe-decrypt plugin, so you know what was exposed while you ran an affected version.
- Review gateway and upstream access logs from the exposure window for requests to those routes that look unusual for your clients.
- If a route protected something sensitive, rotate secrets that sit behind it as a precaution.
- Pin the APISIX version in your build so a rollback cannot bring an affected release back.
Why it matters
A JWE token is encrypted, and part of the format is a value that proves the content was not altered. The record says APISIX did not validate that value properly, which is the weakness class CWE-354. When integrity is not checked, a token can be accepted that should have been refused, and the gateway then lets the caller through.
A gateway sits in front of many services, so one auth flaw there reaches every service behind it. That is why the fix is worth doing quickly even when only a few routes use the plugin.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs. Reachability analysis can then show whether your code actually calls the affected component.
Quick check
Do I need the plugin enabled to be affected?
The record says the issue is in the jwe-decrypt plugin. If you never enable it, the exposure is limited, but upgrade anyway since the fix is a normal minor release.
Sources
- Apache announcement thread (named in the CVE record; its page did not render for me, so details come from the record)
- oss-security post
- Safeguard Gold entry
Last reviewed: 19 October 2026.
