{"id":"CVE-2026-123041","aliases":[],"cve":{"records":[{"id":"CVE-2026-123041","source":"Kong","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-05T08:13:50.698Z","published":"2026-11-10T21:43:16.091Z","modified":"2026-11-13T13:41:26.043Z"}],"publishers":[{"name":"Kong","role":"CNA","organizationId":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","modified":"2026-11-10T21:43:16.091Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T13:41:26.043Z"}],"references":[{"url":"https://developer.konghq.com/gateway/changelog/","tags":["release-notes"],"source":"Kong"},{"url":"https://developer.konghq.com/ai-gateway/changelog/","tags":["release-notes"],"source":"Kong"}],"weaknesses":[{"id":"CWE-524","description":"CWE-524 Use of Cache Containing Sensitive Information","source":"Kong"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T13:41:08.902054Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached…","titleSource":"Kong","descriptionSource":"Kong","description":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another.","score":8.2,"severity":"high","published":"2026-11-10T21:43:16.091Z","modified":"2026-11-13T13:41:26.043Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Kong Inc.","name":"Kong Gateway Enterprise","platforms":[],"versions":[{"version":"3.10.0.0","status":"affected","lessThan":"3.10.0.20","versionType":"custom"},{"version":"3.13.0.0","status":"affected","lessThan":"3.13.0.12","versionType":"custom"},{"version":"3.14.0.0","status":"affected","lessThan":"3.14.0.17","versionType":"custom"},{"version":"3.15.0.0","status":"affected","lessThan":"3.15.0.7","versionType":"custom"},{"version":"3.16.0.0","status":"affected","lessThan":"3.16.0.2","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-123041"},{"vendor":"Kong Inc.","name":"Kong AI Gateway","platforms":[],"versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.1","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-123041"}],"remediation":[],"references":["https://developer.konghq.com/gateway/changelog/","https://developer.konghq.com/ai-gateway/changelog/"],"sources":[{"name":"CVE","id":"CVE-2026-123041","modified":"2026-11-13T13:41:26.043Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123041"}],"assessments":[{"source":"Kong","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.2}],"sourceAffected":[],"observedAt":"2026-11-13T18:01:37.901Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T19:05:32.072Z","attemptedAt":"2026-11-13T19:05:32.072Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T19:00:32.720Z","attemptedAt":"2026-11-13T19:00:32.720Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-13T19:00:32.713Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T19:00:32.756Z","attemptedAt":"2026-11-13T19:00:32.756Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-jhvx-hcq3-vmx2","url":"https://github.com/advisories/GHSA-jhvx-hcq3-vmx2","modified":"2026-11-11T00:32:37Z","checkedAt":"2026-11-13T19:00:32.720Z"},{"source":"FIRST EPSS","id":"CVE-2026-123041","url":"https://www.first.org/epss/","probability":0.00445,"percentile":0.39187,"date":"2026-11-13","checkedAt":"2026-11-13T19:00:32.756Z"},{"source":"NVD","id":"CVE-2026-123041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123041","modified":"2026-11-13T14:17:49.347","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T19:05:32.072Z"}],"aiSummary":{"text":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway may serve a cached callout response to the wrong caller due to omitting callout headers not sent by the client from its cache key. Affected versions include Kong Gateway Enterprise 3.10.0.0 to 3.10.0.19, 3.13.0.0 to 3.13.0.11, 3.14.0.0 to 3.14.0.16, 3.15.0.0 to 3.15.0.6, and 3.16.0.0 to 3.16.0.1, as well as Kong AI Gateway 2.2.0. The weakness is related to the use of cache containing sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T11:01:11.588Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123041"}]}}