Kong Inc. vulnerabilities

Products

• Gateway Enterprise 10
• Ai Gateway 9
• Mesh 7
• Insomnia 2

Newest

• kong inc. ai gateway, gateway enterprise +1 more The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway... CVE-2026-92558 6.3 MediumNovember 10, 2026
• kong inc. ai gateway, gateway enterprise +1 more The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers... CVE-2026-123041 8.2 HighNovember 10, 2026
• kong inc. ai gateway, gateway enterprise +1 more Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request... CVE-2026-92441 7.8 HighNovember 10, 2026
• kong inc. gateway enterprise, ai gateway +1 more The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid... CVE-2026-92439 7.8 HighNovember 10, 2026
• kong inc. gateway enterprise The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies... CVE-2026-96437 8.2 HighNovember 10, 2026
• kong inc. ai gateway, gateway enterprise +1 more The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached... CVE-2026-92443 8.2 HighNovember 10, 2026
• kong inc. gateway enterprise, ai gateway +1 more The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity... CVE-2026-92442 8.3 HighNovember 10, 2026
• kong inc. ai gateway, gateway enterprise +1 more The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway... CVE-2026-92545 8.7 HighNovember 10, 2026
• kong inc. ai gateway, gateway enterprise +1 more SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow... CVE-2026-92544 8.7 HighNovember 10, 2026
• kong inc. gateway enterprise, ai gateway +1 more Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated... CVE-2026-105986 8.7 HighNovember 10, 2026
• kong inc. mesh Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier CVE-2026-18674 7.0 HighAugust 17, 2026
• kong inc. mesh Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity CVE-2026-18677 6.0 MediumAugust 12, 2026
• kong inc. mesh Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid CVE-2026-18675 5.3 MediumAugust 12, 2026
• kong inc. mesh Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication CVE-2026-18673 5.3 MediumAugust 12, 2026
• kong inc. mesh Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured CVE-2026-18679 5.8 MediumJuly 16, 2026
• kong inc. mesh Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured CVE-2026-18678 5.5 MediumJuly 16, 2026
• kong inc. mesh Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin CVE-2026-18676 5.1 MediumMay 14, 2026
• kong inc. insomnia Arbitrary Code Execution in Kong Insomnia Desktop Application CVE-2025-1087 9.3 CriticalMay 9, 2025
• kong insomnia Kong Insomnia profapi.dll untrusted search path CVE-2025-1353 Disputed 7.3 HighFebruary 16, 2025