Kong vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20251
3. 20265

Newest CVEs

• CVE-2026-1907

  SQL Injection in Clustering Communication (Hybrid Mode)

  Kong · Kong Enterprise Gateway

  High7.5
• CVE-2026-14916

  Kong API Gateway Enterprise: JWT Algorithm-Confusion

  Kong · Kong Enteprise Gateway

  High7.7
• CVE-2026-14917

  Kong API Gateway Enterprise: SAML Authentication bypass

  Kong · Kong Enterprise Gateway

  High7.7
• CVE-2026-17578

  Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

  Kong · Kong Event Gateway

  Low2.3
• CVE-2026-6338

  HTTP request smuggling in Kong Enteprise Gateway

  Kong · Kong Enterprise Gateway

  Medium4.9
• CVE-2025-1353

  Kong Insomnia profapi.dll untrusted search path

  Kong · Insomnia

  High7.3
• CVE-2020-36661

  Kong lua-multipart multipart.lua is_header redos

  Kong · lua-multipart

  Low3.5