Vulnerability details
CVE-2026-14916
Kong Enteprise Gateway
Kong API Gateway Enterprise: JWT Algorithm-Confusion
CVSS 4.0
7.7High
Official description
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.7High | 4.0 | CVEProject cvelistV5 (CNA) (Kong) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Kong | Kong Enteprise Gateway | 3.10.0.0 ≤ v < 3.10.0.17 | CVEProject cvelistV5 (CNA) |
| Kong | Kong Enteprise Gateway | 3.12.0.0 ≤ v < 3.12.0.10 | CVEProject cvelistV5 (CNA) |
| Kong | Kong Enteprise Gateway | 3.13.0.0 ≤ v < 3.13.0.9 | CVEProject cvelistV5 (CNA) |
| Kong | Kong Enteprise Gateway | 3.14.0.0 ≤ v < 3.14.0.12 | CVEProject cvelistV5 (CNA) |
| Kong | Kong Enteprise Gateway | 3.15.0.0 ≤ v < 3.15.0.3 | CVEProject cvelistV5 (CNA) |
| Kong | Kong Enteprise Gateway | 3.4.0.0 ≤ v < 3.4.3.29 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://developer.konghq.com/gateway/changelog/ release-notes
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-16
- Last updated
- 2026-09-16
- State
- Published
- Assigner (CNA)
- Kong
Exploit prediction (EPSS)
0.69%
Probability of exploitation in 30 days
53.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-241Improper handling of unexpected data type