Kong Enterprise Gateway vulnerabilities

2 known vulnerabilities in Kong Enterprise Gateway from Kong. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Kong Enterprise Gateway: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-1907Oct 12, 2026Kong

  A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unau

• 7.7 High severity

  Kong Enterprise Gateway: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-14917Sep 16, 2026Kong

  A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned asserti