Input Content-Safety Bypass in Kong Gateway Enterprise ai-azure-content-safety Plugin
CVE-2026-96437

8.2HIGH

Key Information:

Vendor

Kong Inc.

Status
Kong Gateway Enterprise
Vendor
CVE Published:
10 November 2026

What is CVE-2026-96437?

The ai-azure-content-safety plugin integrated within Kong Gateway Enterprise is designed to enhance input validation; however, it has a significant flaw. It fails to inspect request bodies that exceed the in-memory body buffer size. This oversight allows potentially harmful prompts to circumvent crucial content-safety checks, posing risks for applications leveraging this functionality.

Affected Version(s)

Kong Gateway Enterprise 3.13.0.0 < 3.13.0.12

Kong Gateway Enterprise 3.14.0.0 < 3.14.0.11

Kong Gateway Enterprise 3.15.0.0 < 3.15.0.4

References

https://developer.konghq.com/gateway/changelog/
release-notes

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

devchathu
.