CVE-2026-92558: Medium severity kong Kong Gateway Enterprise vulnerability

Published Nov 10, 2026

Updated

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route.

Affected Software

2 affected components

kong Kong Gateway Enterprise

kong Kong AI Gateway

Event History

Nov 10, 2026

CVE Published

via MITRE·09:45 PM

Data Sourced

via MITRE·09:45 PM

DescriptionWeakness

Data Sourced

via NVD·10:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments of Kong Gateway Enterprise or Kong AI Gateway that use the proxy-cache or proxy-cache-advanced plugin are affected. The available information does not identify specific affected versions or configurations.

Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates that the attack is network-reachable and requires no attacker privileges or user interaction. It also indicates that an additional attack condition must be present.

What is the practical impact of a successful exploit?

An attacker can cause a cached response associated with one request to be returned for a different request on the same Route. The supplied severity data rates integrity and availability impact as low and confidentiality impact as none.

CVE-2026-92558: Medium severity kong Kong Gateway Enterprise vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful exploit?