CVE-2026-92441

A routed request could alter headers forwarded to an upstream

Kong · Kong AI Gateway regex route forwarding

First documented disclosure · Review checkpoint

Summary

The gateway forwarded decoded path data without keeping it separate from HTTP header syntax. The upstream could interpret a different request or headers from what the gateway intended.

Severity and exploitation evidence

High · 7.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The gateway forwarded decoded path data without keeping it separate from HTTP header syntax.

Conditions required

A matching regular-expression route forwarded requests to an upstream.

Potential impact

The upstream could interpret a different request or headers from what the gateway intended.

Affected versions and configurations

Kong AI Gateway 2.2.0. Enterprise branch ranges are listed separately in the CNA record.

Fix and mitigation status

Kong AI Gateway 2.2.1.

Practical next steps

Upgrade AI Gateway to 2.2.1 and review the affected gateway configuration.

Operating lesson

Validate forwarded request headers after normalizing a route.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources