Kong Gateway Enterprise: Incorrect authorization in Admin API RBAC
Summary
Kong Gateway Enterprise and Kong AI Gateway contain an incorrect authorization flaw in the RBAC of the Admin API. A delegated administrator can escalate privileges by using a percent-encoded role name or by assigning a role to themselves. The attacker needs valid delegated administrator credentials and network access to the Admin API. The CVSS 4.0 score of 8.7 is provided by the CNA Kong; NVD analysis is still pending.
Affected
- Kong Gateway Enterprise 3.10.0.0 to before 3.10.0.20
- Kong Gateway Enterprise 3.13.0.0 to before 3.13.0.12
- Kong Gateway Enterprise 3.14.0.0 to before 3.14.0.17
- Kong Gateway Enterprise 3.15.0.0 to before 3.15.0.7
- Kong Gateway Enterprise 3.16.0.0 to before 3.16.0.2
- Kong AI Gateway 2.2.0 to before 2.2.1
Fixed in
- Kong Gateway Enterprise 3.10.0.20, 3.13.0.12, 3.14.0.17, 3.15.0.7 or 3.16.0.2, depending on the branch
- Kong AI Gateway 2.2.1 (according to the CVE record)
Workaround
Unknown. No vendor workaround has been published. As general hardening, restrict Admin API access to trusted management networks only; this is not a confirmed mitigation for this issue.
Exploitation
Not known to be exploited in the wild. No public proof of concept was found in the sources reviewed. CISA KEV status was not verified.
Our recommendation
- Inventory all Kong Gateway Enterprise and AI Gateway instances and their exact build numbers.
- Make sure the Admin API and Kong Manager are not reachable from the internet.
- Update to the fixed build for your branch. Verify the 3.14 and 3.15 fixes in the changelog before rollout.
- Review delegated administrator accounts and roles, and check RBAC change logs for unexpected role assignments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kong Gateway changelog developer.konghq.com
- Kong AI Gateway changelog developer.konghq.com
- CVE record mirror (threatint) cve.threatint.com
- Strix CVE summary www.strix.ai
- OffSeq threat radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:02.
Original description (NVD)
Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.