CVE-2026-92439

CVSS 7.8 (high) · published 2026-11-10

The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong.

Weakness: CWE-287

Source: NVD CVE-2026-92439

References

• https://developer.konghq.com/ai-gateway/changelog/
• https://developer.konghq.com/gateway/changelog/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.