{"id":"CVE-2026-92443","aliases":[],"cve":{"records":[{"id":"CVE-2026-92443","source":"Kong","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T10:24:57.218Z","published":"2026-11-10T21:31:03.318Z","modified":"2026-11-13T13:40:15.813Z"}],"publishers":[{"name":"Kong","role":"CNA","organizationId":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","modified":"2026-11-10T21:31:03.318Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T13:40:15.813Z"}],"references":[{"url":"https://developer.konghq.com/gateway/changelog/","tags":["release-notes"],"source":"Kong"},{"url":"https://developer.konghq.com/ai-gateway/changelog/","tags":["release-notes"],"source":"Kong"}],"weaknesses":[{"id":"CWE-524","description":"CWE-524 Use of Cache Containing Sensitive Information","source":"Kong"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T13:40:03.972145Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or…","titleSource":"Kong","descriptionSource":"Kong","description":"The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers.","score":8.2,"severity":"high","published":"2026-11-10T21:31:03.318Z","modified":"2026-11-13T13:40:15.813Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Kong Inc.","name":"Kong Gateway Enterprise","platforms":[],"versions":[{"version":"3.10.0.0","status":"affected","lessThan":"3.10.0.20","versionType":"custom"},{"version":"3.13.0.0","status":"affected","lessThan":"3.13.0.12","versionType":"custom"},{"version":"3.14.0.0","status":"affected","lessThan":"3.14.0.17","versionType":"custom"},{"version":"3.15.0.0","status":"affected","lessThan":"3.15.0.7","versionType":"custom"},{"version":"3.16.0.0","status":"affected","lessThan":"3.16.0.2","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-92443"},{"vendor":"Kong Inc.","name":"Kong AI Gateway","platforms":[],"versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.1","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-92443"}],"remediation":[],"references":["https://developer.konghq.com/gateway/changelog/","https://developer.konghq.com/ai-gateway/changelog/"],"sources":[{"name":"CVE","id":"CVE-2026-92443","modified":"2026-11-13T13:40:15.813Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92443"}],"assessments":[{"source":"Kong","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.2}],"sourceAffected":[],"observedAt":"2026-11-13T18:01:46.340Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T19:05:58.760Z","attemptedAt":"2026-11-13T19:05:58.760Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T19:00:37.437Z","attemptedAt":"2026-11-13T19:00:37.437Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-13T19:00:34.933Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T19:00:36.942Z","attemptedAt":"2026-11-13T19:00:36.942Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-92443","url":"https://www.first.org/epss/","probability":0.00445,"percentile":0.39185,"date":"2026-11-13","checkedAt":"2026-11-13T19:00:36.942Z"},{"source":"GitHub Advisory Database","id":"GHSA-qhwv-f2p7-7fxg","url":"https://github.com/advisories/GHSA-qhwv-f2p7-7fxg","modified":"2026-11-11T00:32:44Z","checkedAt":"2026-11-13T19:00:37.437Z"},{"source":"NVD","id":"CVE-2026-92443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92443","modified":"2026-11-13T14:18:03.973","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T19:05:58.760Z"}],"aiSummary":{"text":"Kong Gateway Enterprise and Kong AI Gateway caching plugins may serve cached responses to different callers, potentially exposing sensitive information. Affected versions include Kong Gateway Enterprise 3.10.0.0 to 3.10.0.19, 3.13.0.0 to 3.13.0.11, 3.14.0.0 to 3.14.0.16, 3.15.0.0 to 3.15.0.6, and 3.16.0.0 to 3.16.0.1, as well as Kong AI Gateway 2.2.0. The weakness is related to the use of cache containing sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T03:06:09.529Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92443"}]}}