CVE-2026-14916: Kong API Gateway JWT Auth Bypass Vulnerability

CVE-2026-14916 Overview

CVE-2026-14916 is a JWT signature verification vulnerability in Kong API Gateway Enterprise. The flaw affects components performing JWT validation for MCP OAuth2 or DataKit integrations. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. This mismatch enables algorithm confusion attacks against the token verification logic.

An unauthenticated remote attacker can craft a forged JWT that the gateway accepts as valid. Successful exploitation results in authentication bypass and can compromise the confidentiality, integrity, and availability of protected resources behind the gateway. The weakness is categorized under [CWE-241: Improper Handling of Unexpected Data Type].

Critical Impact
Unauthenticated attackers can forge JWTs to bypass authentication on Kong API Gateway Enterprise endpoints that use MCP OAuth2 or DataKit JWT validation.

Affected Products

Kong API Gateway Enterprise with MCP OAuth2 integration
Kong API Gateway Enterprise with DataKit integration
Kong components performing JWT validation for the above integrations

Discovery Timeline

2026-09-16 - CVE-2026-14916 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-14916

Vulnerability Analysis

The vulnerability resides in JWT validation logic used by Kong's MCP OAuth2 and DataKit integrations. JSON Web Token (JWT) verification requires the server to enforce a strict binding between the token's declared signing algorithm and the cryptographic key type registered for the issuer. Kong's affected code path does not enforce this binding.

When the algorithm-to-key-type check is missing, an attacker can supply a token whose alg header does not match the expected algorithm. The verifier then processes the token with an inappropriate primitive, producing a false positive validation result. The attacker becomes an authenticated principal without possessing any legitimate signing key.

Exploitation requires only network reachability to the affected gateway route. No credentials, user interaction, or privileged position are required. Attack complexity is low because the forged token can be delivered in a standard HTTP Authorization: Bearer header.

Root Cause

The root cause is improper handling of an unexpected data type during signature verification [CWE-241]. The verifier accepts the algorithm value declared inside the JWT header without confirming that the algorithm family matches the registered verification key. This is the class of flaw commonly described as an algorithm confusion or alg substitution attack.

Attack Vector

The attack vector is remote and network-accessible. An attacker sends a crafted HTTP request to a Kong route protected by the vulnerable MCP OAuth2 or DataKit JWT flow. The request carries a forged JWT whose header specifies an algorithm the verifier will accept against a key of a different type. If the gateway accepts the token, downstream services trust the attacker's claims. This allows access to protected APIs, retrieval of sensitive data, and manipulation of backend state. See the Kong Gateway Changelog for release-specific technical details.

Detection Methods for CVE-2026-14916

Indicators of Compromise

JWTs presented to Kong routes with alg header values that differ from the algorithm expected by the configured verification key
Successful authentications from source IPs that have no history of legitimate API usage against MCP OAuth2 or DataKit endpoints
Bearer tokens whose kid or issuer claims map to keys of a type inconsistent with the declared algorithm

Detection Strategies

Parse Kong access logs and extract JWT headers to flag tokens using unexpected algorithms such as HS256 when an asymmetric key is registered
Correlate authenticated requests against MCP OAuth2 or DataKit routes with the absence of a preceding valid OAuth2 token issuance event
Alert on spikes in 200 OK responses to protected endpoints originating from previously unseen clients or user agents

Monitoring Recommendations

Enable verbose JWT plugin logging on Kong to capture the alg, kid, and issuer of every presented token
Forward Kong gateway logs to a centralized analytics platform and build baseline profiles per API consumer
Monitor upstream service audit logs for privileged operations executed by identities that normally originate only from internal callers

How to Mitigate CVE-2026-14916

Immediate Actions Required

Inventory all Kong API Gateway Enterprise deployments and identify routes using MCP OAuth2 or DataKit JWT validation
Apply the patched Kong Gateway release listed in the vendor changelog as soon as it is available for your environment
Rotate any signing keys that may have been targeted, and revoke long-lived tokens issued during the exposure window

Patch Information

Kong publishes fix details in the Kong Gateway Changelog. Administrators should upgrade to the fixed release identified for CVE-2026-14916 and validate that the MCP OAuth2 and DataKit plugins enforce algorithm-to-key-type binding after the upgrade.

Workarounds

Disable the MCP OAuth2 and DataKit JWT flows on affected routes until the patch is deployed
Front the gateway with an additional authentication layer, such as mutual TLS, that does not rely on the vulnerable JWT verification path
Restrict network access to Kong management and data-plane endpoints to trusted client networks using firewall or service-mesh policy

bash

# Example: temporarily disable a vulnerable JWT-based plugin on a route
curl -X PATCH http://kong-admin:8001/routes/<route-id>/plugins/<plugin-id> \
  --data "enabled=false"