CVE-2026-1907
Received Received - Intake

Kong Gateway SQL Injection in Hybrid Mode

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Kong

Description
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-1907
EUVD
EUVD-2026-97300

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Kong Kong Enterprise Gateway 3.10.0.0
Kong Kong Enterprise Gateway 3.11.0.0
Kong Kong Enterprise Gateway 3.12.0.0
Kong Kong Enterprise Gateway 3.13.0.0
Kong Kong Gateway 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL Injection (SQLi) vulnerability in Kong Gateway (both Enterprise and Open Source) that affects the clustering communication logic when operating in Hybrid Mode. It can be triggered by sending specially crafted RPC requests to the Control Plane (CP), potentially leading to unauthorized database access. Exploiting this requires network access to the Control Plane’s clustering port and a valid client certificate and key.

Detection Guidance

Detecting this SQL Injection vulnerability requires monitoring for unusual RPC requests to the Control Plane's clustering port. Inspect network traffic for malformed SQL queries or unexpected database access patterns. Check Kong Gateway logs for errors related to clustering or RPC requests. Use tools like tcpdump or Wireshark to capture traffic on the clustering port.

Impact Analysis

The vulnerability allows attackers with network access and valid credentials to execute unauthorized SQL commands on the database used by Kong Gateway. This could result in data breaches, unauthorized data manipulation, or complete database compromise, depending on the database permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Organizations using Kong Gateway in Hybrid Mode may face regulatory penalties, legal liabilities, and reputational damage due to potential data exposure.

Mitigation Strategies

Immediately upgrade to Kong Gateway version 3.16.0.0 or later to address the vulnerability. Ensure the Control Plane's clustering port is not exposed to untrusted networks. Restrict access to the clustering port using firewalls or network policies. Rotate client certificates and keys used for clustering authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart