Apache says an unauthenticated client may supply an identity value that an upstream application treats as gateway-verified. The issue affects APISIX 3.18.0 through 3.19.0 under specific plugin settings, and Apache recommends version 3.20.0.The configuration check matters as much as the version check. Routes using jwe-decrypt with strict set to false need a separate forwarded identity header for the described path. A different exposure can arise with forward-auth degradation enabled when its authorization service is unavailable.
What it allows
How Does CVE-2026-124679 Spoof an APISIX Identity?
Apache describes two ways a client-supplied identity can cross a trust boundary. With jwe-decrypt, strict set to false and a forward_header distinct from the token header create the stated condition. An unauthenticated client may then supply a value that the upstream treats as decrypted by the gateway.
Apache says a similar result can occur with forward-auth when allow_degradation is true and the authorization service is unavailable. The upstream can receive a client-supplied identity as though authorization succeeded. These are conditional paths; the advisory does not say every APISIX route is exposed.
Our defensive reading is to check where upstream services rely on APISIX-forwarded identity and which routes use the named settings. A version alone cannot establish a working bypass in a particular deployment. The vulnerability intelligence platform is the relevant Brandefense product page for tracking the affected deployments and fix evidence.
Brandefense Blackhole counted one dark-chat post mentioning CVE-2026-124679 from 16 August through 14 November 2026. That is one discussion record, not a confirmed intrusion or proof of exploitation. CISA's KEV catalog snapshot dated 13 November 2026 did not list this CVE; the KEV catalog explainer describes what such a listing means.
Who is affected
Which APISIX Versions and Configurations Are Affected?
Apache lists APISIX 3.18.0 through 3.19.0 and recommends upgrading to 3.20.0. For jwe-decrypt routes, inspect whether strict is false and whether forward_header differs from the token header. For forward-auth routes, inspect whether allow_degradation is true and whether the authorization service can become unavailable.
Inventory running instances and record their plugin settings before prioritizing remediation. Identify upstream applications that accept identity information forwarded by APISIX, then review their access records for unexpected identity use. This is defensive triage inferred from Apache's stated conditions, rather than evidence of an attack.
Apache gives one inclusive affected span and one fixed release, without branch-specific boundaries. Check the running version after the upgrade and verify that it is 3.20.0 or later. Retest authentication behavior through approved defensive checks and confirm the upstream uses only trusted identity values. The vulnerability management process guide can help record that verification.
Timeline
- 2026-11-13
Apache disclosed CVE-2026-124679 and recommended APISIX 3.20.0.
- 2026-11-13
NVD published the CVE record; the CISA KEV snapshot dated that day did not list it.
What to do
-
Inventory affected APISIX instances
Record running APISIX versions and find instances from 3.18.0 through 3.19.0. Map routes using jwe-decrypt or forward-auth to upstream applications that accept forwarded identity.
-
Review the named plugin conditions
Check jwe-decrypt strict and forward_header settings. Check forward-auth allow_degradation and authorization-service availability. Prioritize deployments where the advisory conditions coincide.
-
Upgrade to Apache APISIX 3.20.0
Follow Apache's recommended fixed release. Until rollout, review whether the named permissive settings are necessary and restrict sensitive access where operationally feasible.
-
Verify the fix and identity trust boundary
Confirm the running version is 3.20.0 or later after deployment. Recheck plugin settings and upstream identity handling, then review access records for unexpected identity use.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124679 in Apache APISIX?
Apache describes an authentication bypass where a client-supplied identity can be treated as gateway-verified under particular jwe-decrypt or forward-auth settings.
Which APISIX release fixes CVE-2026-124679?
Apache recommends version 3.20.0. Its advisory lists 3.18.0 through 3.19.0 as affected.
Does this flaw affect every APISIX deployment?
The advisory names specific plugin settings and an authorization-service failure condition. Review the running version and those configurations before classifying a deployment as exposed.
Is CVE-2026-124679 known to be exploited?
Its exploitation status remains unknown in this profile. The CISA KEV snapshot dated 13 November 2026 did not list it, and a discussion mention does not establish exploitation.
Sources
- CVE-2026-124679: Apache APISIX client-supplied identity headerApache Software Foundation
- CVE-2026-124679 recordNIST NVD
- Known Exploited Vulnerabilities catalogCISA
