Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kong Gateway ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch u.a. Informationen offenzulegen.
Product
Kong Gateway ist ein Open-Source-API-Gateway, das APIs und Microservices verwaltet, sichert und erweitert.
Vulnerabilities 9
-
High 8.7
Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate p…
-
High 8.7
SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute ar…
-
High 8.7
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostna…
-
High 8.3
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allo…
-
High 8.2
The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client …
-
High 8.2
The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying a…
-
High 7.8
The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for …
-
High 7.8
Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-P…
-
Medium 6.3
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator…
Revision history
-
#1
Initiale Fassung
References
-
Kong Gateway changelog 3.16.0.2 vom 2026-11-10
https://developer.konghq.com/gateway/changelog