Description
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Kong Inc. | Kong Gateway Enterprise | unaffected |
|
||||||||||||||||||
| Kong Inc. | Kong AI Gateway | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Tue, 10 Nov 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another. | |
| Weaknesses | CWE-524 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Kong
Published:
Updated: 2026-11-10T21:26:47.098Z
Reserved: 2026-09-16T10:24:55.906Z
Link: CVE-2026-92442
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-524
Use of Cache Containing Sensitive Information