KONG GATEWAY ENTERPRISE · CVE-2026-96437 · AI agents & MCP
FIX → 3.16.0.1 +3 ✓ verified
In Kong Gateway Enterprise, the ai-azure-content-safety plugin skips input checks on request bodies larger than the in-memory body buffer, so prompts in oversized requests reach the LLM unchecked (fails open, CWE-636). Kong's fix inspects bodies up to 10 MiB and rejects ones it cannot read.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-managed or hybrid Kong Gateway Enterprise 3.13 to 3.16 with the ai-azure-content-safety plugin enabled for request (input) checking in front of AI Proxy. Anyone can send a large body to skip the filter, so it matters most if the filter is your only guardrail. Skip it if you do not use this plugin or run Kong OSS.
Not affected if kong-oss, plugin-not-enabled
Who cares ai-gateway, azure-ai-content-safety, kong-gateway, llm, self-hosted
kong version on each node (Enterprise 3.13.0.0-3.13.0.11, 3.14.0.0-3.14.0.10, 3.15.0.0-3.15.0.3, 3.16.0.0 are affected)The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.16.0.1 +3
3.13.0.12, 3.14.0.11, 3.15.0.4 or 3.16.0.1 (or later; 3.16.0.2 is current)3.13.0.12 now inspects request bodies up to 10 MiB and rejects unreadable ones