API gateways in 2026: revisit Kong, Apache APISIX and Traefik before you put another gateway in front of your services

Manoj Shukla
October 13, 2026

Picture an agri-inputs distributor in Indore (an invented example, not a real client). Dealers order seed, fertiliser and crop-protection products from a mobile and web app. Behind the app sit a set of Java and Go services on Kubernetes: catalogue, pricing, inventory, dealer credit and billing. Two NBFCs pull partner APIs for dealer credit checks, and about 300 dealer billing apps call a price and order API with keys that were issued years ago. Today the edge is an NGINX box with hand-written Lua for API keys and a per-IP rate limit that treats one dealer’s forty counter PCs as a single client. After a dealer’s leaked key was used to pull price lists during the Navratri pre-booking rush, the platform lead asked three engineers for a real API gateway. One wants Kong Gateway because it already appears in the company’s Helm charts. A second wants Apache APISIX for etcd and the long plugin list. A third says the cluster already runs Traefik for Ingress, so just add middlewares.

All three are open-source L7 proxies that can sit in front of HTTP services with routing, authentication plugins or middlewares, and rate limits. They are not service meshes, not an identity provider and not only a Kubernetes Ingress controller, though each has a Kubernetes story. This post compares Kong Gateway OSS, Apache APISIX and Traefik Proxy as self-hosted API gateways: architecture, config store, auth and rate limiting in the open-source builds, canary behaviour, Kubernetes companions, licences and security. Facts come from release notes, official documentation, source repositories, licence files and CVE records, checked on 13 October 2026. The drill near the end is my own run on this Linux box.

The short version

An API gateway’s job is consumer identity, credentials, per-consumer quotas, transformations and routing. An Ingress controller’s job is to map Kubernetes Ingress or Gateway API objects to a proxy. Traefik Proxy sits closest to the Ingress end; Kong OSS and APISIX sit closer to the consumer and plugin end. Link that contrast once to the earlier Ingress NGINX retirement post.
Kong Gateway OSS 3.9.4 (12 October 2026, 12:57 PM IST) is the current tip of the only OSS line. There is no Kong OSS 3.10; Enterprise from 3.10.0.0 has no free mode. OIDC, mTLS Auth, Canary and Rate Limiting Advanced are Enterprise-only. The Docker Hub kong image still had 3.9.3 as latest on 13 October 2026; tag 3.9.4 was not on Docker Hub yet.
Apache APISIX 3.19.0 (28 September 2026, 10:43 AM IST) is the current tip. It stores config in etcd (or standalone YAML or an API-driven memory store), ships more than 100 bundled plugins including openid-connect and traffic-split, and embeds a dashboard UI since 3.13. Many 2026 CVEs sit in optional auth plugins; 3.19.0 fixes five of them.
Traefik Proxy v3.7.14 (6 October 2026, 1:19 PM IST) is the current tip of the 3.7 line. Config comes from providers (file, Docker, Kubernetes CRDs, Gateway API and others). OSS middlewares include BasicAuth, DigestAuth, ForwardAuth, IPAllowList and RateLimit. JWT, OIDC and APIKey are Traefik Hub middlewares, not OSS.
For the Indore dealer APIs, start from the question “do we need consumers and per-key quotas?” If yes, Kong OSS or APISIX. If the cluster already terminates TLS with Traefik and you only need BasicAuth or ForwardAuth plus RateLimit, Traefik may be enough without a second product.
In my drill, Traefik v3.7.14 and Kong OSS 3.9.4 both blocked unauthenticated calls, accepted valid credentials, returned 429 after the configured limit, and split 1000 requests 900/100 across weighted upstreams. APISIX 3.19.0 did not run on this box (no extractable 3.19.0 package without Docker or a source build).

Where things stand on 13 October 2026

Dates are from each project’s GitHub release page; times are converted from UTC to IST. Licences are from the LICENSE files at the tagged release.

Project

Release

Date (IST)

Notes

Licence

Kong Gateway OSS

3.9.4

12 October 2026, 12:57 PM

Current tip; hybrid-mode clustering RPC SQL injection fix (CVE-2026-1907)

Apache 2.0

Kong Gateway OSS

3.9.3

17 June 2026, 11:32 AM

Security patch on the 3.9 line; Docker Hub latest still pointed here on 13 Oct

Apache 2.0

Kong Gateway OSS

3.9.2

4 June 2026, 12:42 PM

Bundled NGINX security patches

Apache 2.0

Kong Gateway OSS

3.9.0

13 December 2024, 9:47 AM

Last OSS minor; RPC for hybrid mode; kong drain

Apache 2.0

Kong Gateway Enterprise

3.16.0.0

15 September 2026 (date only)

Contrast only; freemode gone since Enterprise 3.10.0.0

Commercial

Kong Operator

2.3.3

12 October 2026, 5:15 PM

Kubernetes companion; README says new K8s development lands here

Apache 2.0

Kong Ingress Controller

3.5.13

7 August 2026, 5:17 PM

Still supported; not the default for new work

Apache 2.0

Apache APISIX

3.19.0

28 September 2026, 10:43 AM

Current tip; five CVE fixes; openapi-to-mcp; Admin API ?wait

Apache 2.0

Apache APISIX

3.18.0

20 August 2026, 1:27 PM

limit-count Sentinel and sliding window; several auth CVE fixes

Apache 2.0

Apache APISIX

3.17.0

16 June 2026, 12:52 PM

Twelve CVE fixes, many in auth plugins

Apache 2.0

APISIX Ingress Controller

2.2.0

18 August 2026, 7:28 AM

Configures APISIX with Gateway API resources; needs Kubernetes 1.31+

Apache 2.0

Traefik Proxy

v3.7.14

6 October 2026, 1:19 PM

Current tip; eight advisories fixed with v2.11.58

MIT

Traefik Proxy

v2.11.58

6 October 2026, 1:14 PM

Legacy 2.11 security line still receiving patches

MIT

Traefik Proxy

v3.7.0

5 May 2026, 10:49 PM

Start of the 3.7 minor (6-month support window from GA)

MIT

Packaging note for operators: on 13 October 2026 the Docker Hub official image kong still listed 3.9.3 as latest (tags refreshed 2 October 2026). Tag 3.9.4 returned 404 from the Hub API. The 3.9.4 Debian package was available from packages.konghq.com. Recheck the image tag before you pin a deploy. Traefik docs already mention a v3.7.15 migration section; v3.7.15 was not released as of this writing, so do not plan on it.

Timeline

Date (IST)

Event

18 November 2014

Kong/kong GitHub repository created

27 April 2015

Kong 0.2.0-2; LICENSE is MIT, Copyright Mashape

August to September 2015

Kong licence changes from MIT (0.4.2) to Apache 2.0 (0.5.0)

14 September 2015

traefik/traefik repository created

6 July 2016

Traefik v1.0.0 (MIT, Containous)

16 October 2017

Mashape rebrands as Kong Inc. and launches Kong Enterprise Edition

April 2019

APISIX created at ZhiLiu (ASF incubator proposal); GitHub repo 10 April 2019

6 June 2019

APISIX open-sourced on GitHub

16 September 2019

Traefik v2.0.0

17 October 2019

APISIX enters the Apache Incubator

15 January 2020

APISIX 1.0

20 March 2020

Kong 2.0.0

15 July 2020

APISIX graduates to an ASF Top-Level Project

23 September 2020

Containous renames itself Traefik Labs; product becomes Traefik Proxy

28 October 2020

APISIX 2.0

12 September 2022

Kong 3.0.0

2 November 2022

APISIX 3.0.0

24 March 2023

APISIX Dashboard 3.0.1, last standalone dashboard release (only for APISIX 3.0)

9 August 2023

Kong 3.4.0: Cassandra removed; first Kong Manager Open Source Edition; beta proxy-wasm

12 February 2024

Traefik v2.11.0

29 April 2024

Traefik v3.0.0

13 December 2024

Kong OSS 3.9.0

27 March 2025

Kong Gateway Enterprise 3.10.0.0: free mode no longer available; no Kong OSS 3.10 tag exists

27 June 2025

APISIX 3.13.0, first release with the embedded new Dashboard

7 November 2025

Traefik 3.6; start of the documented 6-month-per-minor support rule

5 May 2026

Traefik v3.7.0

4 June / 17 June / 12 October 2026

Kong OSS 3.9.2, 3.9.3, 3.9.4 (security patches on the 3.9 line)

15 September 2026

Kong Enterprise 3.16.0.0

28 September 2026

APISIX 3.19.0

6 October 2026

Traefik v3.7.14 and v2.11.58

Two facts change how teams talk about “open-source Kong” in 2026. The Kong/kong repository is still Apache 2.0, and Kong still ships 3.9.x security patches. There has been no OSS minor after 3.9, and Enterprise from 3.10 has no free mode. Community GitHub discussions ask for a clearer statement on the OSS future; treat those as community context, not as a product roadmap.

First question: ingress controller or API gateway?

An ingress controller maps Kubernetes Ingress or Gateway API objects to a reverse proxy: host, path, TLS, upstream Service. An API gateway adds consumers, credentials, per-consumer quotas, request and response transforms, and sometimes a developer portal. The same binary can do both jobs, which is why the comparison gets muddy.

Need

Usually enough

Usually needs a gateway

Terminate TLS and route /orders to a Service

Ingress / Gateway API

Rotate TLS and canary by weight at the edge

Ingress with weights, or Traefik weighted service

Issue API keys to 300 dealers and revoke one key

Consumer + key-auth

Quotas per dealer, not per source IP

Rate limit by consumer

JWT from your own IdP on partner routes

JWT / OIDC plugin or ForwardAuth

Blue-green of one API version for partners

Weighted upstream may do

Canary / traffic-split helps

Traefik Proxy is often already in the cluster as an Ingress controller. Adding BasicAuth, ForwardAuth and RateLimit middlewares may solve a thin edge without introducing Kong or APISIX. If you need a consumer registry, key lifecycle and a large plugin catalogue, Kong OSS or APISIX is the clearer fit. For TLS and Ingress migration details, use the Ingress NGINX retirement post once and keep this post on the gateway angle. Do not treat this as a service mesh decision; mesh traffic policy is a different layer.

What these three products actually are

Kong Gateway OSS 3.9.4

Kong Gateway OSS is built on NGINX and OpenResty. Request-time logic is mostly Lua plugins; Go and JavaScript plugins run through external plugin servers. Wasm filters exist (wasm is off by default) and have been beta since 3.4.0.

Config store options in kong.conf at 3.9.4: database = postgres (default) or database = off. Cassandra was removed in 3.4.0. Three topologies matter in production:

Traditional: every node talks to Postgres, caches entities in memory and polls on db_update_frequency (default 5 seconds), so a multi-node cluster is eventually consistent.
DB-less: entities load from a YAML or JSON declarative file that replaces the entire configuration; decK cannot manage DB-less mode.
Hybrid: a control plane holds the database and Admin API; data planes run DB-less and receive config from the CP on port 8005. Each DP caches the last config on local disk, so DPs keep serving if the CP is down. CVE-2026-1907 sits in this CP clustering RPC path.

The Admin API listens on 127.0.0.1:8001 and 127.0.0.1:8444 by default. Kong Manager OSS listens on 0.0.0.0:8002 / 8445; Workspaces and RBAC described on the commercial Kong Manager pages are Enterprise, not OSS. At tag 3.9.4 the tree under kong/plugins has 45 bundled plugin directories, including key-auth, jwt, basic-auth, hmac-auth, ldap-auth, oauth2, acl, rate-limiting, response-ratelimiting, proxy-cache, request-transformer, response-transformer, prometheus, opentelemetry, zipkin and several ai-* plugins. openid-connect, mtls-auth, canary and rate-limiting-advanced are documented as Enterprise-only: do not plan an OSS deploy around them.

Kubernetes: Kong Ingress Controller 3.5.x is still supported; Kong Operator 2.3.3 is where the project says new Kubernetes development lands. For Postgres HA behind traditional or hybrid mode, the earlier PostgreSQL high availability post is the companion reading.

Apache APISIX 3.19.0

APISIX is also built on NGINX and ngx_lua, with LuaJIT for request-time logic. Built-in plugins are Lua and opt-in. The WebAssembly plugin runtime remains experimental. External plugin runners for Java, Go and Python talk to APISIX over a Unix-socket RPC as sidecars.

Deployment modes:

Traditional: one role serves traffic (port 9080) and the Admin API (port 9180), with config in etcd.
Decoupled: data_plane and control_plane roles share config through etcd; the DP does not expose the Admin API.
Standalone file-driven: the DP reads conf/apisix.yaml (or JSON), checks every 1 second, and applies hot memory updates without replacing worker processes.
Standalone API-driven: full in-memory config via PUT /apisix/admin/configs, meant for the Ingress Controller and ADC; the docs warn not to drive it by hand. 3.19.0 adds ?wait so the call returns 200 once every worker has loaded the config (202 otherwise).

Admin API protection uses X-API-KEY; if admin_key is left empty, APISIX generates one and writes it back to config.yaml. allow_admin is an IP allow-list. mTLS can protect the Admin API and etcd. The embedded dashboard lives at http://127.0.0.1:9180/ui/ and has been on by default since 3.13 (deployment.admin.enable_admin_ui: true). The old standalone dashboard 3.0.1 is only for APISIX 3.0.

At tag 3.19.0 there are well over 100 Lua files under apisix/plugins (helpers included). Useful OSS capabilities for an API edge include key-auth, jwt-auth, openid-connect, basic-auth, hmac-auth, ldap-auth, ldap-auth-advanced (from 3.18), forward-auth, multi-auth, limit-count / limit-req / limit-conn, traffic-split (documented canary and blue-green examples), prometheus, opentelemetry, zipkin and many loggers. limit-count supports local counters (per instance; aggregate about quota times instances) or redis / redis-cluster / redis-sentinel; Sentinel and sliding window arrived in 3.18.0. For Redis as a shared counter store, the earlier Redis, Valkey and Dragonfly post is the store choice, not a gateway choice.

Kubernetes: APISIX Ingress Controller 2.2.0 configures APISIX using Gateway API resources and needs Kubernetes 1.31+.

Traefik Proxy v3.7.14

Traefik is a Go binary. Install (static) config comes from file, CLI or environment. Routing (dynamic) config comes from providers and “can change and is seamlessly hot-reloaded, without any request interruption or connection loss.” Providers include Docker, Swarm, Kubernetes IngressRoute (CRD), Kubernetes Ingress, Kubernetes Ingress NGINX, Kubernetes Gateway API, Consul Catalog, Nomad, ECS, File, Consul KV, Etcd, ZooKeeper, Redis and HTTP. There is no database of Traefik’s own and no write Admin API. The API and dashboard show active routes; the docs advise against exposing them publicly and against enabling them in production unless secured.

The model is entrypoints, routers, middlewares (router-level then service-level) and services (weighted round robin by default, plus p2c and hrw; weighted, mirroring and failover service types; health checks; sticky sessions). Plugins use Yaegi (interpreted Go) or http-wasm (middleware only). Adding a plugin needs a change to install config. The Plugin Catalog is a SaaS listing.

OSS HTTP middlewares that matter for an API edge: BasicAuth, DigestAuth, ForwardAuth, IPAllowList, RateLimit (token bucket with average / period / burst; optional redis block in the v3.7 docs). Traefik Hub lists APIKey, JWT, OIDC, LDAP, HMAC, OPA, WAF and Distributed Rate Limiting as Hub features. Plan OSS auth as BasicAuth, DigestAuth or ForwardAuth to an IdP such as the ones compared in the Keycloak and its alternatives post. Do not assume JWT or OIDC middlewares exist in OSS because they appear in the Hub-oriented docs navigation.

Gateway API support: Standard v1.6.3; HTTPRoute core plus some extended features, BackendTLSPolicy, GRPCRoute, TLSRoute; TCPRoute from the Experimental channel. There is no separate Traefik Ingress controller package: the providers are built in.

Feature comparison

Need

Kong Gateway OSS 3.9.4

APISIX 3.19.0

Traefik Proxy v3.7.14

Config source

Postgres, DB-less file, or hybrid CP to DP

etcd, standalone YAML/JSON, or API-driven memory

Providers (labels, CRDs, Ingress, Gateway API, file, KV, HTTP)

Admin write API

Yes (localhost by default)

Yes (9180, admin key)

No; read-only API/dashboard

Kong Manager OSS

Embedded Dashboard (/ui/, on by default since 3.13)

Dashboard of active routes

Key auth

key-auth

Not in OSS middleware table (APIKey is Hub)

JWT

jwt

jwt-auth

Not in OSS (JWT is Hub); use ForwardAuth or a plugin

OIDC

openid-connect is Enterprise only

openid-connect bundled

Not in OSS (OIDC is Hub)

Other auth

basic, hmac, ldap, oauth2, session, acl

basic, hmac, ldap, ldap-auth-advanced, cas, saml, opa, casbin, casdoor, keycloak authz, forward-auth, multi-auth, wolf-rbac

BasicAuth, DigestAuth, ForwardAuth, IPAllowList

Rate limiting

rate-limiting: local / cluster / redis (DB-less: local / redis). Rate Limiting Advanced is Enterprise

limit-count / limit-req / limit-conn; local or redis family

RateLimit token bucket; optional redis block. Distributed Rate Limiting is listed under Hub

Canary / blue-green

Canary plugin is Enterprise; OSS can weight upstream targets

traffic-split with canary and blue-green examples

Weighted service, mirroring, failover

Downstream mTLS

mTLS Auth plugin is Enterprise; Service has upstream TLS fields

Route mTLS, upstream client cert, Admin/etcd mTLS

TLS options clientAuth; docs warn conflicting options on one host can drop clientAuth

Observability

prometheus, opentelemetry, zipkin, datadog, statsd, many log plugins

prometheus, opentelemetry, zipkin, skywalking, many loggers

OpenTelemetry metrics, traces and logs (per Traefik product pages)

Kubernetes

KIC 3.5.x and Kong Operator 2.3.3

Ingress Controller 2.2.0 (Gateway API)

Built-in Ingress, IngressRoute, Ingress NGINX provider, Gateway API

Wasm

proxy-wasm filters, off by default

Proxy-Wasm, experimental

http-wasm, middleware only

Other languages

Go and JavaScript plugin servers

Java / Go / Python runners

Yaegi Go

AI / MCP

ai-proxy and other ai-* in OSS 3.9.4

ai-proxy family, mcp-bridge, openapi-to-mcp (3.19.0)

AI Gateway and MCP Gateway are Hub add-ons

Auth and identity in practice

Pattern

Kong OSS

APISIX

Traefik OSS

Static API key per dealer

key-auth + consumers

Not native; ForwardAuth or Hub APIKey

Username/password at the edge

basic-auth

BasicAuth (htpasswd)

JWT signed by your services

jwt plugin

jwt-auth (patch promptly; see CVEs)

ForwardAuth or Hub JWT

OIDC against Keycloak / similar

Enterprise openid-connect, or terminate at an IdP and trust headers carefully

openid-connect plugin

ForwardAuth to the IdP

Per-consumer ACL

acl plugin

consumer labels / authz plugins

Not the same model

ForwardAuth is the OSS escape hatch when the gateway itself should not own OIDC. Put Keycloak, Authelia or another IdP behind ForwardAuth and keep identity out of the proxy. That is the path Traefik OSS expects for anything richer than BasicAuth.

Ops and licences

Topic

Kong OSS 3.9.4

APISIX 3.19.0

Traefik v3.7.14

Config propagation

Traditional: poll ~5 s. DB-less: full replace. Hybrid: CP push; DP keeps last config on disk

etcd watch; standalone file every 1 s, hot memory update

Dynamic config hot-reload; install config and plugins need restart

Upgrade posture

Dual-cluster or in-place (traditional); CP first then rolling DPs (hybrid); rolling (DB-less)

Read CHANGELOG carefully: 11 breaking notes in 3.19.0, 14 in 3.18.0

From 3.6, each minor supported 6 months from GA; patch releases can change behaviour (read migration notes)

Clustering of the OSS binary

Hybrid CP/DP or shared Postgres

etcd-backed traditional/decoupled

No built-in OSS cluster; Hub lists distributed LE, distributed rate limit, cluster dashboard

Licence at tip tag

Apache 2.0

MIT (unchanged since v1)

Commercial line

Kong Gateway Enterprise / Konnect; freemode gone since Enterprise 3.10

None required for the ASF project

Traefik Hub API Gateway and API Management

Official benchmarks

Kong publishes per-version numbers (label as Kong’s own run if quoted)

APISIX publishes a GCP wrk page (label as the project’s own run)

No official benchmark used here

Prefer when:

Prefer

When

Kong Gateway OSS

You want Admin API + consumers + key-auth/jwt on an OpenResty stack, hybrid CP/DP, and you accept staying on the 3.9.x OSS line or licensing Enterprise for OIDC/canary/advanced limits

Apache APISIX

You want etcd, a very large OSS plugin set including openid-connect and traffic-split, and you will keep auth plugins patched

Traefik Proxy

You already run Traefik for Ingress/Gateway API, need BasicAuth or ForwardAuth plus RateLimit and weighted services, and do not need a consumer registry in the proxy

Security and CVEs

Numbers below are from CVE Program records and GitHub repository advisories, checked on 13 October 2026. Prefer CVE Program records or cveawg API records links; NVD detail pages often return 403 to automated clients. Report CNA and NVD scores separately when they differ. This section is a patch checklist, not a reason to abandon any product.

Kong Gateway

CVE-2026-1907 (published 12 October 2026, about 2:08 PM IST): SQL injection in hybrid-mode clustering RPC on the Control Plane. Affects Kong Gateway OSS before 3.9.4 and several Enterprise 3.10 to 3.13 builds. CVSS 4.0 7.5 HIGH (Kong as CNA). Needs network access to the CP clustering port plus a valid client certificate and key. Fixed in OSS 3.9.4.
CVE-2026-6338: HTTP request smuggling, Kong Gateway Enterprise 3.4 and 3.10 to 3.14 series; CVSS 4.0 4.9 MEDIUM.
CVE-2026-14917 / CVE-2026-14916: Enterprise SAML and JWT issues (7.7 HIGH); not OSS plugin surface in the same way.
CVE-2026-15228 / CVE-2026-16543: KIC and Kong Operator embedded KIC; namespace Secret can cause cluster-wide ingress config DoS (7.1 HIGH).
Kong OSS 3.9.2 patched several NGINX CVEs (including CVE-2026-42945 and CVE-2026-9256 at CNA v4.0 9.2 CRITICAL). Those are NGINX issues Kong bundled fixes for.
Do not treat CVE-2026-49975 as a Kong or NGINX gateway issue: Kong’s 3.9.3 changelog cites it for a header-count patch, but the CVE record describes Apache HTTP Server mod_http. ID mismatch.

Apache APISIX

APISIX had a dense 2026 CVE season, almost all in optional auth and identity plugins rather than the core router. Highlights fixed by tip releases:

Fixed in

Examples

Notes

3.19.0

CVE-2026-94212 (saml-auth signature bypass, 6.4), CVE-2026-94250 (batch-requests OOM, 8.2), CVE-2026-94269 (encoded path to protected upstream, 6.3), CVE-2026-94276 (OIDC introspection multi-issuer, 5.1), CVE-2026-94220 (feishu/dingtalk CSRF, 2.1)

Published about 1 October 2026

3.18.0

CVE-2026-74848 (response smuggling on serverless routes), CVE-2026-75005 (graphql-limit-count CPU pin), CVE-2026-75020 (LDAP injection), CVE-2026-63041 (attach-consumer-label authz bypass)

3.17.0

CVE-2026-39999 (jwt-auth bypass; CNA 7.0, NVD 9.1), CVE-2026-44087 (OIDC identity header spoof; CNA 5.3, NVD 9.1), CVE-2026-49230 (jwe-decrypt), forward-auth / hmac / cas / opa / wolf-rbac set

Twelve CVEs on one day

3.16.0

CVE-2026-31908 (forward-auth header injection, 9.1 CRITICAL), CVE-2026-31923 (OIDC ssl_verify false by default, 7.5)

Pattern: keep APISIX on the tip minor if you enable auth plugins, read default plugin configs, and turn on TLS verification for OIDC. The CNA versus NVD score gap (for example jwt-auth 7.0 versus 9.1) is real; quote both if you file an internal risk note.

Traefik Proxy

Traefik’s 2026 advisory stream is large. Many items still have only GHSA IDs. Cite GHSA when no CVE exists.

v3.7.14 / v2.11.58 (advisories about 7 October 2026): GHSA-fh26-gfpp-7xxx (snicheck skipped when req.TLS is nil over HTTP/2 :scheme http, high 7.0); several NTLM/Negotiate/Kerberos connection-pool identity leaks (GHSA-qm9f-w54v-q2qh, GHSA-cw35-4q88-3rmp, GHSA-53qr-784g-cj35); three Ingress NGINX provider issues (GHSA-rv2h-qh7j-xrjw, GHSA-qvj7-gq9c-hp7q, GHSA-mwrr-6hp4-pxr6); GHSA-mhjw-hmjv-p99x (HTTP/2 sticky round tripper race); GHSA-2272-4vv8-65ww (negated Host matcher disables client-cert auth, fixed earlier in 3.7.13 for some ranges).
v3.7.13 / v2.11.57: CVE-2026-88007 (HTTP/3 backend NTLM connection reuse, CVSS 4.0 9.1 CRITICAL); CVE-2026-88009 (rootless HTTP/1 request-target bypasses path-scoped routing/middleware, 8.8 HIGH); CVE-2026-88008, CVE-2026-88004, CVE-2026-88010.
v3.7.11 / v2.11.55: GHSA-5w68-77r2-r64c (complete authentication bypass in digestAuth, critical CVSS 4.0 9.3, no CVE listed); GHSA-g55h-rg46-x9c5 and GHSA-j994-9gqj-9hwq (TLS option confusion / same-host Ingress conflict bypasses mTLS).
Earlier 2026: CVE-2026-71327 (Gateway API route identity collision), CVE-2026-53622 and CVE-2026-48491 (mTLS / SNICheck bypasses), CVE-2026-48020 (StripPrefix auth bypass via path normalisation).

Pattern: a cluster of mTLS and TLS-option conflicts, path-normalisation bypasses, and issues in the Ingress NGINX provider added in 3.7. That matches Traefik’s own TLS options docs warning that conflicting options on the same host can silently drop clientAuth. Stay on v3.7.14 or newer for 3.7, and read migration notes even for patch upgrades (v3.7.13 and v3.7.14 both carried behaviour changes).

Practical controls

Patch to the tip versions in the table above before you enable new auth plugins.
Do not expose Admin API, Kong Manager, APISIX Admin/UI or Traefik dashboard ports to the internet.
Prefer consumer-keyed rate limits over source-IP limits when dealers share NAT or office Wi-Fi.
Treat ForwardAuth and identity headers as a trust boundary: strip client-supplied identity headers before the auth step.
For hybrid Kong, restrict the CP clustering port and client certificates; CVE-2026-1907 needs both.
On Traefik, avoid DigestAuth until you are past the GHSA-5w68-77r2-r64c fixed builds; prefer BasicAuth or ForwardAuth.
Wire OpenTelemetry at the gateway and keep traces short-lived; the distributed tracing backends post covers where those spans go.

Decision guide for the Indore scenario

The Indore team needs: API keys for about 300 dealers, revoke-one-key without touching NGINX Lua, quotas that do not collapse forty counter PCs into one IP, partner routes for two NBFCs, and a canary path for a new pricing API during festival load.

Option

Fit

Cost of the choice

Keep NGINX + Lua

Familiar

Key lifecycle and per-dealer quotas stay custom; the leak showed the gap

Traefik only (already in cluster)

Good for TLS, routing, BasicAuth/ForwardAuth, RateLimit, weighted canary

No native API key consumers in OSS; dealer keys need ForwardAuth or Hub

Kong Gateway OSS 3.9.4

Strong for key-auth, jwt, rate-limiting by consumer, weighted upstreams, hybrid

Stay on 3.9.x or buy Enterprise for OIDC/canary/advanced limits; pin the real 3.9.4 artefact (deb was available when the Docker tag was not)

Apache APISIX 3.19.0

Strong for key-auth, openid-connect, traffic-split, etcd, large plugin set

Must keep auth plugins patched; etcd (or standalone mode) is another moving part

Recommendation for this invented Indore case:

Decide the product is an API gateway, not only Ingress. Dealer keys and per-dealer quotas are the requirement.
Shortlist Kong OSS 3.9.4 and APISIX 3.19.0. Keep Traefik as the cluster Ingress/Gateway API layer if it is already there; do not force it to become the consumer registry.
Prefer APISIX if you want OSS OIDC and traffic-split without an Enterprise licence, and you will run a monthly plugin CVE review.
Prefer Kong OSS if the team already knows Kong, wants hybrid CP/DP with disk-cached DP config, and can live with OSS rate-limiting plus weighted targets (or budget Enterprise later).
Put NBFC partner login behind your IdP (see the Keycloak alternatives post) and ForwardAuth or openid-connect, not a shared static key.
Move rate limits to consumer (or authenticated user) keys; keep a coarser IP limit only as a safety net.
Prove revoke-key, 429 behaviour and a weighted canary in a drill before Navratri load, not during it.
For canary of product behaviour that is not only traffic weight, use a feature flag service; see the feature flags post.

Checklist before you standardise

Write down whether you need consumers and credentials, or only routing and TLS.
List Enterprise-only or Hub-only features your design assumes (OIDC, mTLS Auth, Canary, advanced/distributed rate limits, APIKey/JWT middlewares).
Pin exact versions: Kong 3.9.4, APISIX 3.19.0, Traefik v3.7.14 (or newer patched builds).
Confirm the container or package tag you deploy actually exists (Kong 3.9.4 image lag is a real example).
Lock Admin/UI/dashboard listeners to loopback or a private network; rotate admin keys.
Choose rate-limit keying: consumer first, IP second.
Strip inbound identity headers before authentication.
Document hybrid/etcd/provider failure behaviour (DP cache, etcd outage, file provider reload).
Run one revoke-credential and one 429 test in staging with the real client apps.
Subscribe to GHSA/CVE feeds for the exact repos you run.

Common mistakes

Calling Traefik Hub middlewares (JWT, OIDC, APIKey) as if they were Traefik Proxy OSS.
Designing Kong OSS around openid-connect, mtls-auth, canary or rate-limiting-advanced.
Assuming Docker Hub kong:latest is 3.9.4 because the GitHub tag exists.
Rate limiting by IP in front of dealers who share one office NAT.
Exposing APISIX Admin (9180) or Kong Admin (8001) on a public load balancer.
Skipping APISIX auth-plugin patches because “we only use the router.”
Enabling Traefik DigestAuth on a build older than the GHSA-5w68-77r2-r64c fix.
Treating CVE-2026-49975 as a Kong issue because a changelog mentioned it.
Expecting Traefik OSS to cluster rate-limit counters without Hub or an external store you configure carefully.
Replacing a service mesh discussion with a gateway purchase, or the reverse.

A drill I ran on 13 October 2026

Environment: shared Linux VM, 8 vCPU, about 15 GiB RAM, no root, no Docker, loopback only. Between about 6:41 and 6:56 AM IST I compared what I could run fairly as L7 gateways in front of two Python upstreams (v1-stable on 18081, v2-canary on 18082). Port 8766 (the local HTML paste server) was left untouched.

What ran:

Traefik Proxy v3.7.14 from the official linux_amd64 GitHub release tarball; SHA-256 matched traefik_v3.7.14_checksums.txt. File provider, HTTP only. Entrypoint 18080, API/ping on 18090 (loopback).
Kong Gateway OSS 3.9.4 from the official Debian bookworm .deb on packages.konghq.com, extracted with dpkg-deb -x (no root install). OpenResty from that package; KONG_DATABASE=off; plugins limited to key-auth,rate-limiting so the bundled opentelemetry plugin would not look for missing system proto paths. Proxy 18180, Admin 18181, status 18182. Docker Hub still had no kong:3.9.4 tag at drill time; the deb did.
Apache APISIX 3.19.0: not executed. The apiseven Debian repo listed apisix up to 3.16.0 (bullseye); no 3.19.0 package to extract, and a source build needs apisix-runtime plus luarocks. Equivalent standalone YAML was written and parse-checked only.

Checks (one sequential Python client, smoke test, not a benchmark):

Traefik v3.7.14
  ready (ping 200, 3 file routers) in 0.086 s; idle RSS 91 MiB, 100 MiB after tests
  API: PUT router -> 405 (read-only)
  BasicAuth: no/wrong/unknown/forged header only -> 401; valid -> 200, upstream saw dealer101,
    Authorization removed; forged X-Auth-User with valid creds -> upstream still dealer101
  RateLimit avg 5/s burst 10 by X-Auth-User: 50 back-to-back -> 10 ok / 40 x 429 per dealer
  Same limit by IP: dealer101 10 ok, dealer202 0 ok / 50 x 429 (shared 127.0.0.1)
  Middleware order: RateLimit before BasicAuth with forged per-request X-Auth-User -> 50/50 ok
    (limit bypassed); correct order -> 10 ok / 40 x 429
  Weighted 9:1, 1000 requests -> 900 / 100
  File promote/rollback under traffic: switch in ~27 to 33 ms, 0 non-200 in ~1,650 requests/phase

Kong Gateway OSS 3.9.4 (DB-less)
  /status/ready 200 in 0.423 s; 3 nginx processes; idle RSS sum 162 MiB, 183 MiB after tests
  Admin: POST /services in DB-less -> 405 (expected)
  key-auth: no/wrong/forged header only -> 401; valid -> 200, upstream saw dealer101, apikey hidden
  rate-limiting second=5 policy local by consumer: 5 ok / 45 x 429 per dealer
  by IP: dealer101 5 ok, dealer202 0 ok / 50 x 429
  Weighted targets 90:10, 1000 requests -> 900 / 100
  POST /config promote/rollback under traffic: 201 in 14 to 19 ms; switch ~19 to 25 ms; 0 non-200

APISIX 3.19.0
  not run; cfg/apisix.yaml and cfg/apisix-config.yaml YAML-parse OK only

What this shows:

Both Traefik (BasicAuth) and Kong OSS (key-auth) blocked unauthenticated access and ignored forged identity headers when credentials were missing or wrong.
Per-identity rate limits isolate dealers; per-IP limits do not, which is exactly the Indore NGINX failure mode.
Middleware/plugin order matters: on Traefik, RateLimit before BasicAuth let a client forge X-Auth-User per request and bypass the per-user bucket.
Weighted upstreams on both products hit 900/100 on 1000 sequential requests in this run.
DB-less Kong and Traefik file provider both accepted full config replacement under traffic with no non-200 responses in these runs.
APISIX absence is an environment limit (no Docker/root, no 3.19.0 deb), not a product judgement.

Limits of the drill: one VM and loopback; no TLS; no etcd; no APISIX runtime; no hybrid Kong CP/DP; no OIDC; no Redis-backed shared counters; no Kubernetes providers; timings include Python client overhead and are a smoke test, not a benchmark. Artefacts, configs and results are under /workspace/revisit/drill32/. All processes started for the drill were stopped afterwards.

Unlearn / re-learn

Unlearn

Ingress and API gateway are the same decision.
Whatever appears in a vendor docs navigation is in the open-source build.
Docker Hub latest matches the GitHub release tag on the day you need it.
A per-IP rate limit protects partner APIs.
One quiet year of CVEs means auth plugins are done.

Re-learn

Consumers, credentials and per-consumer quotas are the gateway test; routing alone is Ingress.
Read the OSS plugin or middleware table, not the Hub or Enterprise catalogue, when you self-host.
Pin artefacts you have verified (deb, tarball, image digest), then watch GHSA/CVE feeds.
Practise revoke-key, 429 and canary weight changes before festival traffic.

Closing

Self-hosted API gateways in 2026 still centre on three practical open-source options. Learn how each one stores config: Postgres or declarative files for Kong, etcd or standalone files for APISIX, providers for Traefik. Unlearn the habit of treating Traefik Hub or Kong Enterprise plugin names as free, and of rate-limiting partner APIs by office IP. Re-learn the licence lines (Apache 2.0 for Kong OSS and APISIX, MIT for Traefik) and the edition lines (Kong OSS stuck on 3.9.x, Traefik Hub for JWT/OIDC/APIKey). Practise with a small drill like the one above: one upstream, one credential, one rate limit, one weighted canary. Apply one gateway in front of the dealer and partner APIs, keep Ingress for cluster TLS if you already have it, and put identity somewhere you can revoke it quickly.

Sources

Kong Gateway

Apache APISIX

Traefik Proxy

Security (CVE Program records and selected GHSA)

Internal Revisit.Tech links used in the body

comments powered by Disqus

Releted Posts

Distributed tracing in 2026: revisit Jaeger, Grafana Tempo and SigNoz before you store another span

Manoj Shukla
October 13, 2026

Picture a bus, train and hotel booking platform in Kochi (an invented example, not a real client). Customers book from an Android app, an iOS app and a web app.

Manoj Shukla
October 12, 2026

Picture a test-preparation and online classes platform in Jaipur (an invented example, not a real client). Students use an Android app, an iOS app and a React web app.

Manoj Shukla
October 12, 2026

Picture a payments and lending analytics platform in Hyderabad (an invented example, not a real client). Card authorisations and EMI schedules still land in PostgreSQL 16.