Kong Gateway Enterprise: SAML assertion audience restriction not enforced
Summary
The SAML plugin in Kong Gateway Enterprise does not enforce the AudienceRestriction of SAML assertions. An attacker holding a valid assertion issued for another Service Provider that trusts the same Identity Provider can replay it to authenticate to Kong. The CVSS v4.0 base score is 7.8 (high), mainly due to impact on systems beyond the gateway.
Affected
- Kong Gateway Enterprise 3.10.0.0 to before 3.10.0.20
- Kong Gateway Enterprise 3.13.0.0 to before 3.13.0.12
- Kong Gateway Enterprise 3.14.0.0 to before 3.14.0.17
- Kong Gateway Enterprise 3.15.0.0 to before 3.15.0.7
- Kong Gateway Enterprise 3.16.0.0 to before 3.16.0.2
- Kong AI Gateway before 2.2.1 (according to the CVE record; the AI Gateway changelog lists the fix in 2.3.0, unconfirmed)
- Open-source Kong Gateway is not listed; plugin availability there was not verified.
Fixed in
- Kong Gateway Enterprise 3.10.0.20, 3.13.0.12, 3.14.0.17, 3.15.0.7 and 3.16.0.2 or later
- Kong AI Gateway 2.2.1 according to the CVE record (unconfirmed, the changelog states 2.3.0)
Workaround
- Unknown. No vendor-documented workaround is available. Upgrading is the recommended fix.
- Interim measure: verify that the audience value in the SAML plugin matches the IdP and SP settings exactly, and review SAML login logs for unexpected assertions.
Exploitation
- Not listed in the CISA KEV catalog.
- No public proof-of-concept detected in the sources reviewed.
- Offseq reports: not known to be exploited.
- NVD analysis pending at the time of writing.
Our recommendation
- Check whether Kong Gateway Enterprise with the SAML plugin is used for SSO. If not, no action is needed.
- Upgrade to the fixed build for your branch as soon as possible.
- Test SSO logins after the upgrade, because existing logins can fail if the audience value is not an exact match for the issuer.
- Check whether the same Identity Provider serves other applications, as this is the main prerequisite for the attack.
- Monitor SAML login logs for unexpected assertions.
- Verify the AI Gateway fix version with Kong, as the sources disagree.
- CVE-2026-14917 is a separate SAML bypass fixed in 3.15.0; patching to the latest fixed build covers both.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-92439 www.cve.org
- Kong Gateway changelog developer.konghq.com
- Kong AI Gateway changelog developer.konghq.com
- Kong SAML plugin changelog developer.konghq.com
- Offseq threat radar CVE-2026-92439 radar.offseq.com
- Strix CVE-2026-92439 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:01.
Original description (NVD)
The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.