Kong Inc. Kong Gateway Enterprise
10 CVEs affecting Kong Inc. Kong Gateway Enterprise. Latest disclosed: 2026-11-10. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-96437 | | 2026-11-10 | The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to byp… | |
CVE-2026-92558 | | 2026-11-10 | The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key… | |
CVE-2026-92545 | | 2026-11-10 | The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a… | |
CVE-2026-92443 | | 2026-11-10 | The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization t… | |
CVE-2026-92442 | | 2026-11-10 | The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to… | |
CVE-2026-92441 | | 2026-11-10 | Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing H… | |
CVE-2026-92439 | | 2026-11-10 | The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed… | |
CVE-2026-123041 | | 2026-11-10 | The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached ca… | |
CVE-2026-92544 | | 2026-11-10 | SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database vi… | |
CVE-2026-105986 | | 2026-11-10 | Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role nam… |