SQL Injection Vulnerability in Kong Gateway Enterprise and Kong AI Gateway
CVE-2026-92544

8.7HIGH

Key Information:

Vendor

Kong Inc.

Status
Kong Gateway Enterprise
Kong Ai Gateway
Vendor
CVE Published:
10 November 2026

What is CVE-2026-92544?

A vulnerability exists in Kong Gateway Enterprise and Kong AI Gateway that permits SQL injection through crafted model names used in LLM usage counters. This weakness can lead to unauthorized execution of arbitrary SQL commands against the underlying database, potentially compromising sensitive information and altering database states. It is crucial for users of these products to apply proper input validation and update to mitigate risks associated with this vulnerability.

Affected Version(s)

Kong AI Gateway 2.2.0 < 2.2.1

Kong Gateway Enterprise 3.10.0.0 < 3.10.0.20

Kong Gateway Enterprise 3.13.0.0 < 3.13.0.12

References

https://developer.konghq.com/gateway/changelog/
release-notes
https://developer.konghq.com/ai-gateway/changelog/
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amine Abdelghani Laaredj (axmine_0)
.