What happened
A cluster of catalogued high-severity defects in Kong's enterprise/AI gateway, published 2026-11-10, affect the LLM-facing control plane: SQL injection through the crafted model name in LLM usage counters (CVE-2026-92544), multiple cache-key defects that let a response cached for one hostname/caller/request be served to another (CVE-2026-92545, 123041, 92443, 92558), CR/LF header injection and request smuggling via X-Forwarded-Prefix on regex Routes (CVE-2026-92441), and a bypass where the ai-azure-content-safety plugin skips bodies larger than the in-memory buffer (CVE-2026-96437).
Why it matters
Kong AI Gateway sits in front of LLM backends and is precisely the trust boundary between clients and models. Cache-key/auth defects can leak one tenant's LLM responses to another; SQLi in usage counters can tamper with billing/metadata; the content-safety bypass lets prompt-injection or abusive prompts evade Azure AI moderation; and header smuggling can reach the upstream model provider. These directly undermine the gateway's confidentiality and content-safety guarantees for AI deployments.
Attack vector
A crafted client request reaches the gateway: (a) crafted model name triggers SQL injection in LLM usage counters (CVE-2026-92544, CVSS 8.7); (b) proxy-cache keys omit the request hostname (92545), omit callout headers (123041), don't escape separator characters (92558), and reuse a cache entry for a request carrying Authorization/Proxy-Authorization (92443) — all allowing a response cached for one caller/hostname to be served to another; (c) decoded CR/LF in the request path on regex Routes is placed into X-Forwarded-Prefix, enabling HTTP header injection / request smuggling to the upstream (92441); (d) the ai-azure-content-safety plugin skips inspection of bodies larger than the in-memory buffer, letting prompts bypass input content-safety checks (96437).
Affected systems
Kong Gateway Enterprise and Kong AI Gateway (caching plugins proxy-cache/proxy-cache-advanced, request-callout plugin, ai-azure-content-safety plugin, regex Route X-Forwarded-Prefix handling, LLM usage counters). Fixed in a November 2026 Kong release per the AI Gateway / Gateway changelog.
Mitigation
Upgrade Kong Gateway Enterprise / AI Gateway to the fixed release in the November 2026 changelog; review proxy-cache key construction, disable/limit caching on authenticated routes, validate model names, bound or size-limit content-safety inspection, and enforce strict regex-Route path normalization. See developer.konghq.com/ai-gateway/changelog for the patched versions.