CVE-2021-27306: Konghq Kong Gateway

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.

Affected products

• Konghq Kong Gateway: before 2.3.2.0 (fixed in 2.3.2.0)

Published 2021-03-18. Last modified 2026-06-17.