What is the fix for CVE-2026-105986?

Upgrade Kong Gateway Enterprise to 3.10.0.20, 3.13.0.12, 3.14.0.17, 3.15.0.7 or 3.16.0.2 (per branch). Kong AI Gateway: 2.2.1.

Post Share

HIGH8.7CVSS · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

NO KNOWN
EXPLOIT

KONG GATEWAY ENTERPRISE · CVE-2026-105986 · Vendor

Kong Gateway Enterprise: delegated admin can elevate privileges via RBAC flaw

Q: Who is not affected by CVE-2026-105986?

Not affected if: no-delegated-admins, rbac-disabled, single-admin.

FIX → 3.16.0.2 · 2.2.1 +4 ✓ verified

Kong Gateway Enterprise's Admin API role-based access control does not check authorization correctly. A delegated administrator can gain higher privileges by using a percent-encoded role name or by assigning a role to themselves.

first public Nov 10, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Self-managed Kong Gateway Enterprise deployments that use Admin API RBAC and delegate admin rights to other people or teams. A delegated admin can escalate privileges using a percent-encoded role name or by assigning a role to themselves. Teams with no RBAC, a single trusted admin, or the Admin API not reachable by delegated admins can deprioritise it.

Kong Gateway Enterprise>= 3.10.0.0, < 3.10.0.20; >= 3.13.0.0, < 3.13.0.12; >= 3.14.0.0, < 3.14.0.17; >= 3.15.0.0, < 3.15.0.7; >= 3.16.0.0, < 3.16.0.2fixed in 3.10.0.20, 3.13.0.12, 3.14.0.17, 3.15.0.7, 3.16.0.2
Kong AI Gateway>= 2.2.0, < 2.2.1fixed in 2.2.1

Not affected if no-delegated-admins, rbac-disabled, single-admin

Who cares api-gateway, kong, kong-gateway-enterprise, rbac, self-hosted

02 · How to check

Run kong version (or check the image tag/package) on every Enterprise node
You are exposed if the version is in 3.10.0.0-3.10.0.19, 3.13.0.0-3.13.0.11, 3.14.0.0-3.14.0.16, 3.15.0.0-3.15.0.6 or , AND RBAC is enforced (enforce_rbac) with delegated admins whose roles you did not fully trust

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

2 events · Nov 10, 2026 → Nov 10, 2026

Nov 10, 202621:46 UTCNVD CVE-2026-105986
Nov 10, 202622:03 UTCInfraStack Analyst NVD (Kong CNA) lists affected/fixed ranges; Kong changelog 3.16.0.2 (2026/11/10) confirms fix 'applying RBAC self-protection checks consistently'. Only the 3.16 changelog read; other branch fixes come from NVD only. No exploitation or PoC seen.moreless

What the sources say, verbatim

185 characters

Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role.

Sources and references

NVD: CVE-2026-105986Nov 10, 2026
Kong Gateway changelog (3.16.0.2)Fix · developer.konghq.com
NVD CVE-2026-105986 (Kong CNA)Advisory · nvd.nist.gov

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Kong Gateway Enterprise threat the day it hits your stack.

Start free