What is the fix for CVE-2026-92544?

Kong Gateway Enterprise: upgrade to 3.16.0.2 (released 2026-11-10); the 3.15.x branch got a 3.15.0.7 release the same day, but its changelog entry for this CVE was not seen, so confirm it lists CVE-2026-92544. Kong AI Gateway: the fix is listed in the 2.3.0 release (2026-11-04) per the vendor changelog; use 2.3.1 (2026-11-10) or later. Fix escapes every value before the usage counter SQL statement runs.

Post Share

HIGH8.7CVSS · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

NO KNOWN
EXPLOIT

KONG GATEWAY ENTERPRISE · CVE-2026-92544 · AI agents & MCP

Kong AI Gateway: crafted model name lets clients run SQL on the database

FIX → 3.16.0.2 · 2.3.0 ✓ verified

Kong's changelog says a client-supplied model name was written into the license_llm_data table without escaping, allowing SQL injection from the LLM usage counters. Fixed in Gateway Enterprise 3.16.0.2 and in AI Gateway 2.3.0 (2.3.1 is current).

first public Nov 10, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Self-hosted Kong Gateway Enterprise and Kong AI Gateway deployments that count LLM usage (a client-supplied model name is written into the license_llm_data table). A request carrying a crafted model name can run SQL against the Kong database. The CVSS vector says network-reachable with low privileges required, so a valid client credential is probably needed, but Kong's changelog does not say. Teams that do not run Kong Gateway Enterprise or AI Gateway can skip it.

Kong Gateway Enterprise< 3.16.0.2 (older branch ranges unknown)fixed in 3.16.0.2
Kong AI Gateway< 2.3.0fixed in 2.3.0

Not affected if unknown

Who cares kong, kong-ai-gateway, llm-gateway, self-hosted

02 · How to check

Run kong version (or check the image tag) on every Kong Gateway Enterprise and Kong AI Gateway node
Below 3.16.0.2 on Gateway or below 2.3.0 on AI Gateway means the unescaped model name is written to the license_llm_data table
Affected ranges for older branches are not published in the pages read; check Kong's security advisories page for them

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

2 events · Nov 10, 2026 → Nov 10, 2026

Nov 10, 202621:46 UTCNVD CVE-2026-92544
Nov 10, 202621:49 UTCInfraStack Analyst Fix read in Kong's own Gateway and AI Gateway changelogs; no standalone advisory page was readable. Auth requirement and older-branch fixed versions (e.g. 3.15.0.7) unconfirmed. No PoC or exploitation found; X not searched.moreless

What the sources say, verbatim

182 characters

SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name.

Sources and references

NVD: CVE-2026-92544Nov 10, 2026
Kong Gateway changelog (3.16.0.2)Fix · developer.konghq.com
Kong AI Gateway changelogFix · developer.konghq.com

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Kong Gateway Enterprise threat the day it hits your stack.

Start free