Vendor
Kong
25 known vulnerabilities.
Kong at a glance
- Last 12 months
- 22
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 10 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 2 | 0 |
| Aug 2026 | 8 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 1 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 1 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Medium max 8.2WID-SEC-2026-4469 1 CVE
Kong Gateway: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Kong Gateway ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
-
High max 8.7WID-SEC-2026-4488 9 CVEs
Kong Gateway: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kong Gateway ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch u.a. Informationen offenzulegen.
-
Medium max 8.8
cURL: Mehre Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in cURL und libcurl ausnutzen, um einen nicht näher spezifizierten Angriff zu starten.
first Oct 4, 2023 -
High max 7.5WID-SEC-2026-3889 1 CVE
Kong Gateway: Schwachstelle ermöglicht SQL-Injection
Ein Angreifer aus einem angrenzenden Netzwerk kann eine Schwachstelle in Kong Gateway ausnutzen, um eine SQL-Injection durchzuführen.
-
MediumWID-SEC-2026-1638 0 CVEs
Kong Insomnia: Schwachstelle ermöglicht Offenlegung von Informationen
Ein Angreifer kann eine Schwachstelle in Kong Insomnia ausnutzen, um Informationen offenzulegen.
25 results · Feed
-
Medium 6.3
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator…
-
High 8.2
The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client …
-
High 7.8
Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-P…
-
High 7.8
The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for …
-
High 8.2
The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-mem…
-
High 8.2
The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying a…
-
High 8.3
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allo…
-
High 8.7
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostna…
-
High 8.7
SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute ar…
-
High 8.7
Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate p…
-
High 7.5
SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential una…
-
High 7.7
Kong API Gateway Enterprise: JWT Algorithm-Confusion
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible…
-
High 7.7
Kong API Gateway Enterprise: SAML Authentication bypass
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assert…
-
High 7.0
Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones c…
-
Medium 5.8
Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path acto…
-
Medium 5.5
Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control pla…
-
Medium 6.0
Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload …
-
Medium 5.1
Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a maliciou…
-
Medium 5.3
Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic t…
-
Medium 5.3
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no aut…
-
Low 2.3
Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends me…
-
Medium 4.9
HTTP request smuggling in Kong Enteprise Gateway
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.…
-
Critical 9.3
Arbitrary Code Execution in Kong Insomnia Desktop Application
Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which…
-
High 7.0
Kong Insomnia profapi.dll untrusted search path
A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity …
-
Low 3.5
Kong lua-multipart multipart.lua is_header redos
A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to ve…