SQL Injection Vulnerability in Kong Gateway by Kong Technologies
CVE-2026-1907

7.5HIGH

Key Information:

Vendor

Kong

Status
Kong Enterprise Gateway
Kong Gateway
Vendor
CVE Published:
12 October 2026

What is CVE-2026-1907?

A SQL Injection vulnerability has been identified in the Kong Gateway that compromises the clustering communication logic when operating in Hybrid Mode. This issue can be exploited by sending specially crafted RPC requests to the Control Plane, potentially allowing unauthorized access to the database. To exploit this vulnerability, an attacker must have network access to the Control Plane's clustering port and must also possess a valid client certificate and key.

Affected Version(s)

Kong Enterprise Gateway Linux 3.10.0.0 < 3.10.0.9

Kong Enterprise Gateway Linux 3.11.0.0 < 3.11.0.8

Kong Enterprise Gateway Linux 3.12.0.0 < 3.12.0.4

References

https://developer.konghq.com/gateway/changelog/#3-13-0-2
release-notes
https://github.com/Kong/kong/security/advisories/GHSA-vwx...
vendor-advisory

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

four0four from ZeroVuln Labs
.