Authorization Flaw in Kong Gateway Enterprise by Kong

CVE-2026-105986

What is CVE-2026-105986?

An authorization flaw exists in the Admin API Role-Based Access Control (RBAC) of Kong Gateway Enterprise. This vulnerability permits a delegated administrator to elevate privileges improperly, which can be exploited through the use of percent-encoded role names or by assigning roles to themselves. Organizations using Kong Gateway Enterprise should ensure proper role configurations are in place to mitigate the risk of unauthorized access.

References