CVE-2026-105986: High severity kong Kong Gateway Enterprise vulnerability

Published Nov 10, 2026

Updated

Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role.

Affected Software

1 affected component

kong Kong Gateway Enterprise

Event History

Nov 10, 2026

CVE Published

via MITRE·09:03 PM

Data Sourced

via MITRE·09:03 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Kong Gateway Enterprise Admin API RBAC and delegated administrator accounts are exposed to this issue. The provided information does not state whether any particular default configuration enables the affected conditions.

What access does an attacker need?

An attacker needs delegated administrator privileges. No user interaction is required, and the vulnerability is rated as remotely exploitable with low attack complexity.

How can the privilege elevation be performed?

The delegated administrator can elevate privileges by using a percent-encoded role name or by assigning a role to themselves.

CVE-2026-105986: High severity kong Kong Gateway Enterprise vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

How can the privilege elevation be performed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

How can the privilege elevation be performed?