CVE-2026-14917highCWE-288

CVE-2026-14917: fallo de gravedad alta en Kong Enterprise Gateway

Kong API Gateway Enterprise: SAML Authentication bypass

Publicada el

Seguir esta CVE+ Monitorear Kong Enterprise Gateway

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.8%
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature. As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Productos afectados
Kong · Kong Enterprise Gateway
CVEs relacionadas — Kong Enterprise Gateway

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-6338MEDIUMHTTP request smuggling in Kong Enteprise GatewayEPSS 0.3%CVE-2026-1907HIGHSQL Injection in Clustering Communication (Hybrid Mode)EPSS 0.1%