CVE-2026-49230 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-49230 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-49230 is an improper integrity check validation vulnerability in the jwe-decrypt plugin of Apache APISIX, a widely deployed open-source API gateway, that allows authentication bypass under default configuration.

Technical Detail

The flaw resides in how Apache APISIX's jwe-decrypt plugin validates the integrity of JSON Web Encryption (JWE) tokens. Under the default plugin configuration, the integrity check value is not properly validated, meaning an attacker can craft or tamper with a JWE token and have it accepted as legitimate without possessing the correct key material. Successful exploitation results in authentication bypass, potentially granting an attacker unauthorized access to protected API routes and backend services that rely on the jwe-decrypt plugin for access control enforcement.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit; however, the vulnerability's default-configuration exposure and high CVSS score of 9.1 (Critical) make it a credible target for near-term exploitation development.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability as of June 26, 2026.

What To Do

Organizations running Apache APISIX with the jwe-decrypt plugin enabled should treat this as a priority patch. Apply the latest patched release of Apache APISIX as soon as it becomes available from the Apache Software Foundation, and monitor the official Apache APISIX security advisories for version-specific guidance. As an interim workaround, consider disabling the jwe-decrypt plugin on any routes where it is not strictly required, or restrict access to those routes via network-layer controls until a patch is applied. Detection efforts should focus on anomalous API access patterns, particularly requests reaching protected routes without valid authentication context or with malformed JWE token structures in access logs.