{"id":"CVE-2026-123041","kind":"vulnerability","aliases":["CVE-2026-123041"],"related":[],"title":"Kong Gateway: cached plugin responses leak between different callers","description":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another.","summary":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway leaves callout headers the client did not send out of its cache key. A cached callout response meant for one caller can therefore be served to another caller.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Kong Gateway Enterprise","fixed":["3.16.0.2"],"affected":"unknown; see how-to-check","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","caching","infrastructure","kong","request-callout","self-hosted"],"not_affected_if":["callout-caching-disabled","plugin-not-enabled"],"how_to_check":"Check whether the request-callout plugin is enabled (GET /plugins on the Admin API, or your decK/kong.yaml) with callouts that have a cache configured (config.cache, strategy memory or redis) and callout headers that vary per caller. Run 'kong version' to see your Enterprise build; anything below 3.16.0.2 on the 3.16 line is not shown as fixed. Also check Kong AI Gateway if you use request-callout there.","fix":"Kong Gateway Enterprise: upgrade to 3.16.0.2 (released 2026-11-10), which includes all callout request headers in the request-callout cache key. Fixed versions for older branches and for Kong AI Gateway are not listed on the changelog page I read.","status":"open","published_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:29:05+00:00","updated_at":"2026-11-10T22:38:14+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T22:29:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kong Gateway: cached plugin responses leak between different callers","impact":"medium","summary":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway leaves callout headers the client did not send out of its cache key. A cached callout response meant for one caller can therefore be served to another caller.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kong","api-gateway","request-callout"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"one caller receives another caller's cached callout response","analyst_note":"Check the NVD entry and Kong's advisory for affected and fixed versions and whether caching must be enabled for the flaw to apply.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-enabled"],"who_is_affected":"Teams running Kong Gateway Enterprise or Kong AI Gateway with the request-callout plugin enabled are exposed. Installations without that plugin, or without it caching callout responses, are not described as affected by the sources. The sources do not name the affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4526,"output_tokens":456,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Kong's advisory for affected and fixed versions and whether caching must be enabled for the flaw to apply.","search":"'-123041':12A,15A '-2026':11A,14A 'ai':42B,83C 'allow':97C 'anoth':70B,109C 'api':20B 'api-gateway':19B 'cach':3A,22B,55B,58B,95C,99C 'caller':9A,64B,71B,104C 'callout':27B,34B,45B,59B,75C,86C,100C 'client':48B,92C 'cve':10A,13A 'differ':8A 'enterpris':39B,80C 'enterprise':18A 'gateway':2A,17A,21B,38B,43B,79C,84C 'header':46B,87C 'host':30B 'infrastructur':23B 'key':56B,96C 'kong':1A,16A,24B,37B,41B,78C,82C 'leak':6A 'leav':44B 'meant':61B 'omit':85C 'one':63B 'plugin':4A,35B,76C 'request':26B,33B,74C 'request-callout':25B,32B,73C 'respons':5A,60B,101C 'self':29B 'self-host':28B 'send':51B 'sent':89C 'serv':68B,107C 'therefor':66B","nicknames":[],"mitigations":[],"who_affected":"Teams running Kong Gateway Enterprise or Kong AI Gateway with the request-callout plugin enabled are exposed. Installations without that plugin, or without it caching callout responses, are not described as affected by the sources. The sources do not name the affected versions.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:38:14Z","by":"analyst","doc":"https://developer.konghq.com/gateway/changelog/","run_id":3014}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["gatewayenterprise","konggatewayenterprise"],"ptokens":["enterprise","gateway","kong"],"labels":["apigateway","caching","high","infrastructure","kong","requestcallout","selfhosted"],"campaign_type":null,"search_a":"'-123041':12A,15A '-2026':11A,14A 'cach':3A 'caller':9A 'cve':10A,13A 'differ':8A 'enterprise':18A 'gateway':2A,17A 'kong':1A,16A 'leak':6A 'plugin':4A 'respons':5A","search_b":"'ai':42B 'anoth':70B 'api':20B 'api-gateway':19B 'cach':22B,55B,58B 'caller':64B,71B 'callout':27B,34B,45B,59B 'client':48B 'enterpris':39B 'gateway':21B,38B,43B 'header':46B 'host':30B 'infrastructur':23B 'key':56B 'kong':24B,37B,41B 'leav':44B 'meant':61B 'one':63B 'plugin':35B 'request':26B,33B 'request-callout':25B,32B 'respons':60B 'self':29B 'self-host':28B 'send':51B 'serv':68B 'therefor':66B","search_c":"'ai':83C 'allow':97C 'anoth':109C 'cach':95C,99C 'caller':104C 'callout':75C,86C,100C 'client':92C 'enterpris':80C 'gateway':79C,84C 'header':87C 'key':96C 'kong':78C,82C 'omit':85C 'plugin':76C 'request':74C 'request-callout':73C 'respons':101C 'sent':89C 'serv':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123041","severity":null,"published_at":"2026-11-10T22:18:28+00:00","modified_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123041:3014","url":"https://developer.konghq.com/gateway/changelog/","severity":null,"published_at":"2026-11-10T22:38:14+00:00","modified_at":"2026-11-10T22:38:14+00:00","first_seen_at":"2026-11-10T22:38:14+00:00","fetched_at":"2026-11-10T22:38:14+00:00","note":"Kong's Gateway changelog lists 3.16.0.2 fixing CVE-2026-123041 in request-callout (all callout request headers now in cache key). NVD gave no versions; affected range, older-branch fixes and AI Gateway fix version not found. No exploitation or PoC seen; no social search done (low-profile, no nickname).","cites":["https://developer.konghq.com/gateway/changelog/","https://developer.konghq.com/plugins/request-callout/changelog/"]}],"documents":[{"id":119284,"url":"https://developer.konghq.com/gateway/changelog/","title":"Kong Gateway changelog (3.16.0.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119695,"url":"https://developer.konghq.com/plugins/request-callout/changelog/","title":"Request Callout Plugin Changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}