Cache Key Exposure in Kong Gateway Enterprise and AI Gateway

CVE-2026-92558

What is CVE-2026-92558?

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway fail to properly escape separator characters during cache key construction. This oversight could enable a remote attacker to manipulate cached responses, potentially serving an incorrect cached response for different requests on the same route. As a result, sensitive information may be disclosed, and users could inadvertently receive inappropriate content. It's crucial for users of affected products to review their implementation and apply any security measures or updates to mitigate this issue.

References