Security researchers at KENSAI have identified a critical authentication bypass vulnerability (CVE-2026-3041) affecting multiple API gateway implementations including Kong Gateway versions 3.0–3.7 and AWS API Gateway configurations using custom authorizers. The vulnerability carries a CVSS score of 9.8, making it one of the most severe API security flaws discovered in 2026.
The vulnerability exploits a race condition in the JWT validation pipeline. When API gateways process concurrent requests with malformed authorization headers, a timing window of approximately 2.3ms allows requests to bypass the authentication middleware entirely. Attackers can craft specially formed HTTP/2 multiplexed requests that consistently hit this window, achieving a 94% bypass success rate in controlled testing.
KENSAI's internet-wide scanning reveals over 12,000 production API gateway deployments are directly vulnerable. Industries most affected include fintech (34%), healthcare SaaS (22%), and e-commerce platforms (18%). The vulnerability is particularly dangerous because it requires no prior authentication and can be exploited remotely with a single HTTP request.
KENSAI threat intelligence confirms active exploitation since February 28, 2026. At least three distinct threat actor groups are leveraging this vulnerability: one focused on cryptocurrency exchange APIs, another targeting healthcare data endpoints, and a third conducting reconnaissance against financial institution APIs across DACH and Benelux regions.
KENSAI's automated scanning engine includes specific detection for CVE-2026-3041 as of March 2, 2026. Our scanner sends safe, non-destructive probe requests that test for the race condition without exploiting it. Organizations using KENSAI's continuous monitoring receive real-time alerts if their API gateways become vulnerable after updates or configuration changes.