CVE-2026-92545

CVSS 8.7 (high) · published 2026-11-10

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another.

Weakness: CWE-524

Source: NVD CVE-2026-92545

References

• https://developer.konghq.com/ai-gateway/changelog/
• https://developer.konghq.com/gateway/changelog/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.