PatchSiren cyber security CVE debrief

CVE-2026-47341 Apache Software Foundation CVE debrief

CVE-2026-47341 is a medium-severity Authentication Bypass by Capture-replay vulnerability in Apache APISIX. The issue arises from certain configurations in hmac-auth, allowing an attacker to reuse a token indefinitely and bypass expiry. This vulnerability affects Apache APISIX versions from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0 to fix the issue. The CVSS score for this vulnerability is 6.3. The CVE was published on June 19, 2026, and last modified on the same day.

Vendor: Apache Software Foundation
Product: Apache APISIX
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-19
Original CVE updated: 2026-06-23
Advisory published: 2026-06-19
Advisory updated: 2026-06-23

Who should care

Defenders of Apache APISIX instances, particularly those using versions between 3.11.0 and 3.16.0, should be aware of this vulnerability. Upgrading to version 3.17.0 is recommended to mitigate the risk. This vulnerability could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access.

Technical summary

The vulnerability is caused by a Capture-replay attack in the hmac-auth configuration of Apache APISIX. This allows an attacker to capture and replay authentication tokens, effectively bypassing the expiry mechanism. The affected versions are from 3.11.0 to 3.16.0. The fix is included in version 3.17.0. The CVSS:4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority due to potential for authentication bypass and unauthorized access.

Recommended defensive actions

Upgrade Apache APISIX to version 3.17.0 or later
Review current configurations of hmac-auth in Apache APISIX
Monitor for suspicious authentication attempts
Inventory APISIX instances for version compliance
Apply compensating controls if immediate upgrade is not feasible

Evidence notes

The primary evidence for this vulnerability comes from the CVE record and the NVD detail page. The vulnerability affects Apache APISIX versions from 3.11.0 through 3.16.0. Defenders should verify their current version of Apache APISIX and compare it with the affected versions. The official CVE record and NVD detail provide the most accurate and up-to-date information.

Sources and references

Verified primary and authoritative sources

CVE-2026-47341 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-47341

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-47341 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47341

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://lists.apache.org/thread/ob6ng9x2hxtyfojs839hs1n0v18xxzf2

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.