CVE-2026-49871 is a critical (CVSS 9.3) cross-site request forgery flaw in the cas-auth plugin of Apache APISIX, versions 3.0.0 through 3.16.0. A victim sent to an attacker's page can end up logged in as a different identity. Upgrade to APISIX 3.17.0, which fixes the issue.
What's affected
- Product: Apache APISIX, the open source API gateway.
- Affected: 3.0.0 through 3.16.0, in the cas-auth plugin under default configuration.
- Fixed: 3.17.0, as stated in the CVE record.
- Weakness: CWE-352, cross-site request forgery.
- CVSS 9.3 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The vector shows user interaction is required. - Published 19 June 2026. Not marked as exploited in CISA KEV.
The same release line also fixes CVE-2026-49230 in a different plugin.
How to check if you're exposed
apisix version
If you run the container image, check the image tag in your deployment manifests instead:
docker ps --format '{.Image}' | grep -i apisix
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i apisix
Then confirm whether the plugin is enabled in your configuration. Search your config.yaml and your route and plugin definitions for cas-auth. If no route uses it, this CVE does not apply to your setup, though the upgrade is still worth doing.
What to do now
- Upgrade APISIX to 3.17.0 or later on every node.
- Identify routes that use the cas-auth plugin and the applications behind them.
- Check upstream audit logs for actions attributed to accounts that the real owner says they did not take.
- Tell the owners of those applications what the flaw does, so they know to question odd account activity.
- Add the upgrade to your standard gateway runbook, and track the plugin list per environment.
Why it matters
In a CSRF attack the browser is tricked into sending a request it should not. Here the record says the effect is unusual: the victim's browser becomes authenticated as the attacker's identity, so what the victim does next is recorded under the attacker's account. That can cause the victim to put data into an account the attacker controls.
The class is CWE-352, and the usual defence is a state value that ties the login flow to the session that began it. The fix is in the gateway, so apply the upgrade rather than trying to patch around it in the applications behind it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need the victim to click something?
Yes. The vector marks user interaction as required, because the victim has to be sent to a page the attacker controls.
Sources
- Apache announcement thread (named in the CVE record; its page did not render for me, so details come from the record)
- oss-security post
- Safeguard Gold entry
Last reviewed: 19 October 2026.
