EUVD-2026-80389
GHSA-5qvf-77w7-x85r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable JWT forgery (PR:N/UI:N/AC:L); scope change (S:C) as the gateway flaw compromises protected backends, granting read and impersonation-based write (C:H/I:H), availability not established (A:N).
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
3DescriptionCVE.org
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification.
As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
AnalysisAI
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Kong API Gateway Enterprise deployment to be configured with the MCP OAuth2 or DataKit integration code paths that perform JWT validation - these specific, relatively new integrations are what contain the vulnerable verification logic, so gateways not using them are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine unauthenticated auth-bypass primitive, but its real-world priority is strongly gated by configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kong API Gateway Enterprise to the release identified in the vendor changelog (https://developer.konghq.com/gateway/changelog/) as containing the fix for CVE-2026-14916; the supplied data does not include an exact patched version number, so read the changelog entry rather than assuming one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Kong API Gateway Enterprise deployment and determine which instances have MCP OAuth2 or DataKit JWT validation enabled, then restrict network reachability to those protected endpoints to trusted source ranges or internal segments only; apply an upstream proxy or WAF rule that rejects tokens whose declared algorithm does not match the expected signing algorithm, and enable verbose authentication logging on the affected code paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. Rated cr
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary
A vulnerability was found in Konga 2.8.3 on Kong. Rated medium severity (CVSS 5.9), this vulnerability is remotely explo
Cross-site scripting (XSS) vulnerability in the phptemplate_preprocess_node function in template.php in the Inf08 theme
Same weakness CWE-241 – Improper Handling of Unexpected Data Type
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today