Kong Enterprise Gateway EUVD-2026-80389

Requires the Kong API Gateway Enterprise deployment to be configured with the MCP OAuth2 or DataKit integration code paths that perform JWT validation - these specific, relatively new integrations are what contain the vulnerable verification logic, so gateways not using them are not exposed. Where present, exploitation needs no authentication, no user interaction, and only network reachability to a protected endpoint (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is therefore configuration/feature enablement rather than access controls; the flaw is not reachable in default configurations that omit these JWT-validating integrations, and impact is scoped to the backend resources the gateway protects rather than the gateway host itself.

This is a genuine unauthenticated auth-bypass primitive, but its real-world priority is strongly gated by configuration. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 7.7) shows the flaw is remotely reachable with low complexity and no authentication or user interaction - the ideal profile for mass exploitation. The exploitation technique (JWT algorithm/key-type confusion, e.g. accepting a token signed with an algorithm incompatible with the configured verification key) is a well-documented, easily-weaponized class of bug once the vulnerable code path is reachable. However, the vector deliberately sets vulnerable-system impacts to none (VC:N/VI:N/VA:N) and only subsequent-system confidentiality high (SC:H), modeling that the harm lands on the protected backend resources, not the gateway itself. Crucially, no EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation - this is a vendor-self-reported (Kong) issue, not an observed-in-the-wild one. Net: treat as HIGH priority for the specific subset of deployments running the MCP OAuth2 or DataKit JWT-validation integrations, and lower priority elsewhere, since the vulnerable code path only exists when those integrations are configured. Note a data conflict: the free-text description claims 'potential compromise of confidentiality, integrity, and availability,' yet the official vector only scores subsequent confidentiality (SC:H) - verify actual integrity/availability impact with Kong.

An unauthenticated attacker targets a Kong Enterprise Gateway that fronts protected APIs using the MCP OAuth2 or DataKit JWT validation path. The attacker crafts a forged JWT exploiting the failure to bind the signing algorithm to the verification key type (e.g. an algorithm-confusion token), submits it to a protected endpoint, and the gateway incorrectly accepts it as valid - bypassing authentication and granting access to protected backend resources. No public exploit code is identified at time of analysis, though the underlying algorithm-confusion technique is publicly well-understood.