Skip to content
OpenAdvisories
High · 8.7 CVE-2026-105986 EUVD-2026-122929GHSA-4g87-hprj-5fg3

Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a perc…

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by Kong

Vendor: Kong Product: Kong AI Gateway Product: Kong Gateway Enterprise

Description

Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role.

Affected products

VendorProductAffectedFixed
Kong Kong Gateway Enterprise 3.10.0.0 – < 3.10.0.20, 3.13.0.0 – < 3.13.0.12, 3.14.0.0 – < 3.14.0.17, 3.15.0.0 – < 3.15.0.7, 3.16.0.0 – < 3.16.0.2 3.10.0.20
Kong Kong AI Gateway 2.2.0 – < 2.2.1 2.2.1

Advisories 1

References