Answer in brief
CVE-2026-14916 records a Unknown severity vulnerability in Kong API Gateway Enterprise: JWT Algorithm-Confusion. The current sources do not mark it as known exploited. The current feed maps Kong/Kong Enteprise Gateway (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Kong/Kong Enteprise Gateway (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Kong/Kong Enteprise Gatewaygeneric | >=3.15.0.0 <3.15.0.3 || >=3.14.0.0 <3.14.0.12 || >=3.13.0.0 <3.13.0.9 || >=3.12.0.0 <3.12.0.10 || >=3.10.0.0 <3.10.0.17 || >=3.4.0.0 <3.4.3.29 | 3.15.0.3, 3.14.0.12, 3.13.0.9, 3.12.0.10, 3.10.0.17, 3.4.3.29 |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
Quoted source text, attributed separately from HOL analysis.