kong-pwn

kong-pwn 露出したKongAPIをプロキシとして使い、メタデータURLや内部URLを取得します。 CVE-2020-11710 - これは脆弱性ではなく、設定ミスです。 使用方法 root@kitploit: usage: kong-pwn.py -h -u URL -s SSRF -p PROXY kong-pwn.py: error: the following arguments are required: -u/--url, -s/--ssrf 例 root@kitploit: $ python3 kong-pwn.py -u http://127.0.0.1:8001 ...

CVE-2026-14916

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

CVE-2026-14916 Kong API Gateway Enterprise: JWT Algorithm-Confusion

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

EUVD-2026-80389

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

CVE-2026-14916 Kong API Gateway Enterprise: JWT Algorithm-Confusion

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

CVE-2026-14917 Kong API Gateway Enterprise: SAML Authentication bypass

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

Mastering API Security: Learn the 3 Key Principles at Kong API Summit 2023

In an era where APIs Application Programming Interfaces are the lifeblood of digital interactions, the need for robust API security has never been more critical. According to Gartner research, a staggering 90% of web-enabled applications are predicted to harbor vulnerabilities related to APIs. To...

CVE-2018-0269

A vulnerability in the web framework of the Cisco Digital Network Architecture Center DNA Center could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing CORS policy...

Code injection

A vulnerability in the web framework of the Cisco Digital Network Architecture Center DNA Center could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing CORS policy...

CVE-2018-0269

A vulnerability in the web framework of the Cisco Digital Network Architecture Center DNA Center could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing CORS policy...

CVE-2018-0269

Cisco DNA Center suffers an information-disclosure/unauthenticated-access risk due to an overly permissive CORS policy in its web framework, allowing a remote attacker to communicate with the Kong API server after deceiving a user with a malicious link. The issue is tied to DNA Center’s web API e...

Cisco DNA Center Cross Origin Resource Sharing Vulnerability

A vulnerability in the web framework of the Cisco Digital Network Architecture Center DNA Center could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing CORS policy...