Kong AI Gateway could reuse authenticated or restored AI responses across callers

Kong disclosed that some enterprise and AI Gateway caching plugins could store a response generated for a request with Authorization or Proxy-Authorization headers and return it to another client without preserving the originating principal boundary.

A second defect described in the same maintenance release concerned sanitizer recovery of previously redacted sensitive content, which might also reach a response cache. The advisory for CVE-2026-92443 establishes the authenticated-response cache defect; the distinct sanitizer behavior needs its own evidence before treating both as a single root cause. Shared inference response caches must key on effective identity and avoid caching personal recovered data under a key another user can reuse, regardless of whether the language model generated a benign answer.

The public disclosure does not identify a live leaked customer prompt, prove actual token disclosure, or establish that every Kong cache plugin was susceptible in every configuration. Test the effective cache key with two explicitly different authenticated principals and confidential synthetic responses, then verify patched policy branches.

Evidence reconciliation and effect boundary. The cache is the authority-changing component, because it may reuse a response prepared for one principal when a second principal submits an otherwise matching request. A private output or restored user data can leak without the underlying authorization token appearing in the response. The advisory must be distinguished from Kong flaws involving omitted hostnames, serialized cache-key collisions or an entirely separate GraphQL path, even though all can result in cache identity confusion.