CVE-2026-14917
High
Description
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature. As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
SeverityHigh
CVSS7.7
Exploit probability—
Product
Kong Enterprise Gateway
PublishedSep 16, 2026
First seenSep 16, 2026
Weakness typeCWE-288CWE-288
How to fix
Update
- Kong Kong Enterprise Gateway3.15.0.3, 3.14.0.12, 3.13.0.9, 3.12.0.10, 3.10.0.17, 3.4.3.29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kong Kong Enterprise Gateway | 3.15.0.0 ≤ v < 3.15.0.3, 3.14.0.0 ≤ v < 3.14.0.12, 3.13.0.0 ≤ v < 3.13.0.9, 3.12.0.0 ≤ v < 3.12.0.10, 3.10.0.0 ≤ v < 3.10.0.17, 3.4.0.0 ≤ v < 3.4.3.29 | 3.15.0.3, 3.14.0.12, 3.13.0.9, 3.12.0.10, 3.10.0.17, 3.4.3.29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.