CVE-2026-49871 -- CVSS 9.3 Vulnerability Briefing

CVE-2026-49871 | CVSS 9.3 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-49871 is a Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin for Apache APISIX, present under default configurations.

Technical Detail

The flaw exists in the cas-auth plugin's handling of authentication requests, where the plugin fails to enforce adequate CSRF protections under its default configuration. An attacker can exploit this by directing a victim to an attacker-controlled webpage that issues forged requests on the victim's behalf, potentially resulting in unauthorized actions being performed within the APISIX gateway in the context of the authenticated user. Depending on the privileges of the targeted session, this could lead to configuration tampering, route manipulation, or authentication bypass within the API gateway.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been identified.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been identified in connection with this vulnerability.

What To Do

Organizations running Apache APISIX with the cas-auth plugin enabled should review and apply any available patches or updated plugin versions from the Apache APISIX project. As an interim measure, administrators should consider disabling the cas-auth plugin if it is not operationally required, or restricting access to the APISIX admin interface to trusted network segments only. Implementing additional CSRF protections at the reverse proxy or WAF layer can reduce exposure. Monitor APISIX logs for unexpected configuration changes or unusual authentication activity that may indicate abuse of the cas-auth flow. Given the CVSS score of 9.3, patching should be treated as high priority even in the absence of confirmed active exploitation.