CVE-2026-92442
Quick assessment
Affected
Kong Inc. Kong Gateway Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kong Gateway Enterprise 中的 插件在构建缓存键时遗漏了调用者的身份标识，导致为某一调用者缓存的响应可能被错误地提供给其他调用者。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92442
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过缓存导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kong Inc. | Kong Gateway Enterprise | 3.10.0.0 ~ 3.10.0.20 | - |
|
| Kong Inc. | Kong AI Gateway | 2.2.0 ~ 2.2.1 | - |
|
II. Public POCs for CVE-2026-92442
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92442
请登录查看更多情报信息。
Other References for CVE-2026-92442 (1)
Other References for CVE-2026-92442 (1)
-
https://developer.konghq.com/ai-gateway/changelog/ release-notes
Same Patch Batch · Kong Inc. · 2026-11-10 · 10 CVEs total
| CVE-2026-105986 | 8.7 HIGH | Kong Gateway Enterprise 管理 API RBAC 权限提升漏洞 |
| CVE-2026-92544 | 8.7 HIGH | Kong Gateway 企业版 LLM 计数器 SQL 注入漏洞 |
| CVE-2026-92545 | 8.7 HIGH | Kong Gateway 插件缓存键缺失主机名导致跨域缓存 |
| CVE-2026-92443 | 8.2 HIGH | Kong Gateway 缓存插件跨用户授权响应泄露漏洞 |
| CVE-2026-96437 | 8.2 HIGH | Kong Gateway Enterprise ai-azure-content-safety 插件内容安全绕过漏洞 |
| CVE-2026-123041 | 8.2 HIGH | Kong Gateway 企业版缓存头遗漏漏洞 |
| CVE-2026-92441 | 7.8 HIGH | Kong Gateway 企业版与 AI 版 HTTP 头注入与请求走私漏洞 |
| CVE-2026-92439 | 7.8 HIGH | Kong Gateway Enterprise SAML 插件 AudienceRestriction 绕过漏洞 |
| CVE-2026-92558 | 6.3 MEDIUM | Kong Gateway 插件缓存键未转义导致跨请求缓存 |
IV. Related Vulnerabilities
Same product: Kong Gateway Enterprise
Same vendor: Kong Inc.