---
id: "CVE-2026-92442"
page: "https://infrastack.ai/live/CVE-2026-92442"
kind: "vulnerability"
aliases: ["CVE-2026-92442"]
title: "Kong Gateway: GraphQL proxy cache serves one caller's response to another"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Kong Gateway Enterprise", "fixed": ["3.16.0.2"], "affected": "< 3.16.0.2 (lower bound unknown; plugin graphql-proxy-cache-advanced)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "graphql", "kong-gateway", "self-hosted", "vendor"]
not_affected_if: ["open-source-gateway", "plugin-disabled"]
published_at: "2026-11-10T22:21:14+00:00"
first_seen_at: "2026-11-10T22:27:31+00:00"
updated_at: "2026-11-10T22:36:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92442", "first_seen_at": "2026-11-10T22:27:31+00:00"}, {"source": "analyst", "url": "https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/", "first_seen_at": "2026-11-10T22:36:57+00:00", "cites": ["https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/", "https://developer.konghq.com/gateway/changelog/"]}]
exploit_sources: []
---

# Kong Gateway: GraphQL proxy cache serves one caller's response to another

Link for people: https://infrastack.ai/live/CVE-2026-92442 (this .md is for agents)

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise leaves the caller's identity out of its cache key. An attacker can receive a cached response that was generated for a different user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kong Gateway Enterprise affected < 3.16.0.2 (lower bound unknown; plugin graphql-proxy-cache-advanced) fixed 3.16.0.2

## How to check

- Check whether the graphql-proxy-cache-advanced plugin is enabled on any route, service, consumer or globally (Admin API: GET /plugins, filter name=graphql-proxy-cache-advanced; or your decK/kong.yaml).\n- Check your Kong Gateway Enterprise version (kong version). 3.16.0.2 contains the fix; the affected range below 3.16.0.2 is not stated in the sources I read.\n- Also check older Enterprise branches: Kong's changelog lists no fix for them, so ask Kong support or check their advisory.

## Fix

Kong Gateway Enterprise 3.16.0.2 (released 2026-11-10) adds the authenticated consumer to the graphql-proxy-cache-advanced cache key. Fixed versions on older branches are not stated in the changelog I read.

## Timeline

- 2026-11-10T22:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92442
- 2026-11-10T22:36:57+00:00 analyst https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/ — Fix 3.16.0.2 read in Kong's changelog (vendor). Affected lower bound and older-branch fixes not found; NVD page returned empty. No exploitation or PoC found. No posts searched.

## Documents

- [describes] GraphQL Proxy Caching Advanced plugin https://developer.konghq.com/plugins/graphql-proxy-cache-advanced/
- [fix] Kong Gateway changelog (3.16.0.2) https://developer.konghq.com/gateway/changelog/

## From the sources

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_