Skip to content

An editorial team and a community building with AI

vibecoding.incJoin Discord ↗
← All articles

News · Kong · 2 min read

Event date: · Published:

Kong patches nine CVEs including an LLM content-safety bypass

Kong fixed nine vulnerabilities in Kong Gateway Enterprise and Kong AI Gateway on November 10, 2026, including a flaw that let oversized prompts bypass the Azure Content Safety guardrail.

Kong fixed nine vulnerabilities across Kong Gateway Enterprise and Kong AI Gateway on November 10, 2026, including a bug that let oversized large language model prompts skip the Azure Content Safety guardrail entirely, according to an advisory from GitHub Security Advisories.

What changed

  • Kong disclosed nine CVEs affecting Kong Gateway Enterprise and Kong AI Gateway, fixed on November 10, 2026.
  • CVE-2026-96437 (CVSS 8.2 High): the ai-azure-content-safety plugin skips content-safety inspection of LLM prompts when request bodies exceed its in-memory buffer size, letting unsafe prompts through unchecked.
  • CVE-2026-92544 (CVSS 8.7 High): a crafted LLM model name string is used unsanitized against Kong's database, enabling SQL injection via the LLM usage and billing counter feature.
  • CVE-2026-105986 (CVSS 8.7 High): an Admin API RBAC privilege escalation lets a delegated admin self-escalate using percent-encoded role names.
  • Multiple cache-key vulnerabilities (CVSS up to 8.7 High) let cached responses, including ones containing Authorization headers, leak to unrelated callers or across hostnames.
  • CVE-2026-92439 (CVSS 7.8 High): Kong's SAML plugin fails to enforce AudienceRestriction, letting a SAML assertion issued for one Service Provider be replayed to authenticate to Kong.

What it means for people who build with AI

Teams that run Kong AI Gateway as a prompt-safety and traffic layer in front of LLM endpoints were exposed on two fronts: the oversized-prompt bug meant the content-safety guardrail could be silently skipped instead of failing closed, and the cache-key flaws could leak Authorization headers across tenants or hostnames. Combined with the Admin API privilege escalation and the SAML authentication bypass, the set of fixes makes updating to Kong AI Gateway 2.2.1 urgent for anyone relying on Kong to enforce content policy or isolate tenants.

Availability

The fixes ship in Kong AI Gateway 2.2.1 and in Kong Gateway Enterprise versions 3.10.0.20, 3.13.0.12, 3.14.0.17, 3.15.0.7 and 3.16.0.2, listed as released on 2026/11/10 in Kong's AI Gateway changelog. Technical details on the SQL injection in LLM usage billing are in a second GitHub Security Advisories entry.

Sources

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.

Kong patches nine CVEs including an LLM content-safety bypass | vibecoding.inc