CVE-2026-105986

HighCVSS 8.7/10Last modified Nov 10, 2026

Description

Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Kong Inc.Kong Gateway Enterprise>= 3.10.0.0, < 3.10.0.20; >= 3.13.0.0, < 3.13.0.12; >= 3.14.0.0, < 3.14.0.17; >= 3.15.0.0, < 3.15.0.7; >= 3.16.0.0, < 3.16.0.2
Kong Inc.Kong AI Gateway>= 2.2.0, < 2.2.1

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1059875.1KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker cCVE-2026-1059895.3The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checkCVE-2026-105997.5The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the oCVE-2026-1059905.3The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stoCVE-2026-1059914.3IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing CCVE-2026-1059925.3The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider beforeCVE-2026-1059935.3The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauCVE-2026-1059947.7ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attackerCVE-2026-1059955.3The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing CVE-2026-1059964.8The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriviCVE-2026-1059975.3The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipCVE-2026-1059985.3The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscri
CVE-2026-105986: High severity, CVSS 8.7 | Vulnix