Kong Gateway Enterprise: Cache key omits caller identity in GraphQL proxy cache
Summary
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise does not include the caller's identity in its cache key. A response cached for one caller can therefore be served to another caller, which exposes cached data across callers (CWE-524). The issue applies only when the plugin is enabled and different callers can send matching requests. The CVE record rates it CVSS 4.0 8.3 (High) with network access, no privileges and no user interaction.
Affected
- Kong Gateway Enterprise 3.10.0.0 to before 3.10.0.20
- Kong Gateway Enterprise 3.13.0.0 to before 3.13.0.12
- Kong Gateway Enterprise 3.14.0.0 to before 3.14.0.17
- Kong Gateway Enterprise 3.15.0.0 to before 3.15.0.7
- Kong Gateway Enterprise 3.16.0.0 to before 3.16.0.2
- Kong AI Gateway 2.2.0 to before 2.2.1 (as listed in the CVE record)
Fixed in
- Kong Gateway Enterprise 3.10.0.20, 3.13.0.12, 3.14.0.17, 3.15.0.7 and 3.16.0.2 (the 3.14.0.17 and 3.16.0.2 builds are confirmed only by the CVE record)
- Kong AI Gateway 2.2.1 (not confirmed in the AI Gateway changelog)
Workaround
- Disable the graphql-proxy-cache-advanced plugin on routes that serve per-user or authenticated responses until the update is applied.
- Review the plugin's cache key configuration. Kong has not stated which identity input was omitted.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public proof of concept found. Kong's statement on exploitation: unknown.
Our recommendation
- Update Kong Gateway Enterprise to the fixed build of your release line.
- Prioritise this update if the GraphQL caching plugin runs on authenticated or per-customer APIs.
- Check whether the plugin is enabled and whether an affected build is in use.
- Ask Kong to confirm the CVE ID, because the Gateway changelog cites CVE-2026-92558 for the same cache-key fix.
- Monitor NVD and Kong advisories, as the CVE was published recently and NVD analysis is pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-92442 www.cve.org
- Kong Gateway changelog developer.konghq.com
- Kong AI Gateway changelog developer.konghq.com
- Kong GraphQL Proxy Cache Advanced plugin documentation developer.konghq.com
- OffSeq threat radar entry for CVE-2026-92442 radar.offseq.com
- Strix CVE entry for CVE-2026-92442 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:15.
Original description (NVD)
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.