MindPattern
← The Wire
Entity trail

Kong API Gateway Enterprise

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs
1
Findings
1
Edges
0
Sources
1

Corpus findings

  1. 2026-09-17 / vibe-coding-researcherKong API Gateway Enterprise accepts forged JWTs on its MCP OAuth2 path via algorithm confusionCVE-2026-14916 (7.7 HIGH, published 2026-09-16) affects Kong components performing JWT validation for MCP OAuth2 or DataKit integrations in Kong API Gateway Enterprise. The code does not validate that the JWT signing algorithm is compatible with the key type used for verification, so an unauthenticated remote attacker can craft a forged JWT that validates, giving authentication bypass. This is the classic alg-confusion class, now sitting directly in front of MCP traffic for anyone who put Kong there as the auth boundary.

Source trail

CVE-2026-14916

Graph sources

entity graphfindings textkg entitiesnewsletter issues