{"id":"CVE-2026-92558","aliases":[],"cve":{"records":[{"id":"CVE-2026-92558","source":"Kong","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T13:20:37.821Z","published":"2026-11-10T21:45:39.935Z","modified":"2026-11-13T13:40:50.464Z"}],"publishers":[{"name":"Kong","role":"CNA","organizationId":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","modified":"2026-11-10T21:45:39.935Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T13:40:50.464Z"}],"references":[{"url":"https://developer.konghq.com/gateway/changelog/","tags":["release-notes"],"source":"Kong"},{"url":"https://developer.konghq.com/ai-gateway/changelog/","tags":["release-notes"],"source":"Kong"}],"weaknesses":[{"id":"CWE-116","description":"CWE-116 Improper Encoding or Escaping of Output","source":"Kong"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T13:40:40.194258Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache…","titleSource":"Kong","descriptionSource":"Kong","description":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route.","score":6.3,"severity":"medium","published":"2026-11-10T21:45:39.935Z","modified":"2026-11-13T13:40:50.464Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Kong Inc.","name":"Kong Gateway Enterprise","platforms":[],"versions":[{"version":"3.10.0.0","status":"affected","lessThan":"3.10.0.20","versionType":"custom"},{"version":"3.13.0.0","status":"affected","lessThan":"3.13.0.12","versionType":"custom"},{"version":"3.14.0.0","status":"affected","lessThan":"3.14.0.17","versionType":"custom"},{"version":"3.15.0.0","status":"affected","lessThan":"3.15.0.7","versionType":"custom"},{"version":"3.16.0.0","status":"affected","lessThan":"3.16.0.2","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-92558"},{"vendor":"Kong Inc.","name":"Kong AI Gateway","platforms":[],"versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.1","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-92558"}],"remediation":[],"references":["https://developer.konghq.com/gateway/changelog/","https://developer.konghq.com/ai-gateway/changelog/"],"sources":[{"name":"CVE","id":"CVE-2026-92558","modified":"2026-11-13T13:40:50.464Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92558"}],"assessments":[{"source":"Kong","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","score":6.3}],"sourceAffected":[],"observedAt":"2026-11-13T18:01:48.006Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T19:05:45.985Z","attemptedAt":"2026-11-13T19:05:45.985Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T19:00:35.262Z","attemptedAt":"2026-11-13T19:00:35.262Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-13T19:00:34.299Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T19:00:35.398Z","attemptedAt":"2026-11-13T19:00:35.398Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-rjwg-f57g-669j","url":"https://github.com/advisories/GHSA-rjwg-f57g-669j","modified":"2026-11-11T00:32:43Z","checkedAt":"2026-11-13T19:00:35.262Z"},{"source":"FIRST EPSS","id":"CVE-2026-92558","url":"https://www.first.org/epss/","probability":0.00439,"percentile":0.38712,"date":"2026-11-13","checkedAt":"2026-11-13T19:00:35.398Z"},{"source":"NVD","id":"CVE-2026-92558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92558","modified":"2026-11-13T14:18:04.213","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T19:05:45.985Z"}],"aiSummary":{"text":"Kong Gateway Enterprise and Kong AI Gateway have a vulnerability in the proxy-cache and proxy-cache-advanced plugins, where separator characters are not escaped, allowing an attacker to cause a cached response to be served for a different request. Affected versions include Kong Gateway Enterprise 3.10.0.0 to 3.10.0.19, 3.13.0.0 to 3.13.0.11, 3.14.0.0 to 3.14.0.16, 3.15.0.0 to 3.15.0.6, and 3.16.0.0 to 3.16.0.1, as well as Kong AI Gateway 2.2.0. The weakness is due to improper encoding or escaping of output.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T10:56:12.112Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92558"}]}}