CVE-2026-14917: Kong API Gateway Enterprise: SAML Authentication bypass
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.
As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the Kong SAML plugin option validate_assertion_signature to true (it is enabled by default) to prevent authentication using an unsigned SAML assertion.
Kong SAML plugin validate_assertion_signature = true
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Kong SAML plugin deployments where validate_assertion_signature has been explicitly set to false are affected. The option is enabled by default.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker may submit a crafted SAML response containing an unsigned assertion. The plugin may then extract the asserted identity without validating a cryptographic signature, allowing impersonation of arbitrary users, including administrators.
What can be done before patching?
Ensure validate_assertion_signature is enabled and do not configure it as false. This prevents the plugin from accepting identity information from an unsigned assertion.
How can I determine whether my deployment is at risk?
Review the Kong SAML plugin configuration for validate_assertion_signature. A deployment is at risk if that option is explicitly set to false.