CVE-2026-14916
High
Description
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
SeverityHigh
CVSS7.7
Exploit probability—
Product
Kong Enteprise Gateway
PublishedSep 16, 2026
First seenSep 16, 2026
Weakness typeCWE-241CWE-241
How to fix
Update
- Kong Kong Enteprise Gateway3.15.0.3, 3.14.0.12, 3.13.0.9, 3.12.0.10, 3.10.0.17, 3.4.3.29 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kong Kong Enteprise Gateway | 3.15.0.0 ≤ v < 3.15.0.3, 3.14.0.0 ≤ v < 3.14.0.12, 3.13.0.0 ≤ v < 3.13.0.9, 3.12.0.0 ≤ v < 3.12.0.10, 3.10.0.0 ≤ v < 3.10.0.17, 3.4.0.0 ≤ v < 3.4.3.29 | 3.15.0.3, 3.14.0.12, 3.13.0.9, 3.12.0.10, 3.10.0.17, 3.4.3.29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.