Refine your search
3 vulnerabilities found for Kong Enterprise Gateway by Kong
CVE-2026-1907 (GCVE-0-2026-1907)
Vulnerability from cvelistv5
Published
2026-10-12 08:38
Modified
2026-10-15 18:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Summary
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Kong | Kong Enterprise Gateway |
Version: 3.10.0.0 Version: 3.11.0.0 Version: 3.12.0.0 Version: 3.13.0.0 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:57:43.665281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:07:25.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "kong-ee",
"platforms": [
"Linux"
],
"product": "Kong Enterprise Gateway",
"vendor": "Kong",
"versions": [
{
"lessThan": "3.10.0.9",
"status": "affected",
"version": "3.10.0.0",
"versionType": "kong ee gateway 3.10"
},
{
"lessThan": "3.11.0.8",
"status": "affected",
"version": "3.11.0.0",
"versionType": "kong ee gateway 3.11"
},
{
"lessThan": "3.12.0.4",
"status": "affected",
"version": "3.12.0.0",
"versionType": "kong ee gateway 3.12"
},
{
"lessThan": "3.13.0.2",
"status": "affected",
"version": "3.13.0.0",
"versionType": "kong ee gateway 3.13"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "kong",
"product": "Kong Gateway",
"repo": "https://github.com/Kong/kong",
"vendor": "Kong",
"versions": [
{
"lessThan": "3.9.4",
"status": "affected",
"version": "0",
"versionType": "Kong Gateway 3.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "four0four from ZeroVuln Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eA SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane\u2019s clustering port and a valid client certificate and key.\u003cbr\u003e\u003c/pre\u003e"
}
],
"value": "A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane\u2019s clustering port and a valid client certificate and key."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T08:38:54.485Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://developer.konghq.com/gateway/changelog/#3-13-0-2"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Kong/kong/security/advisories/GHSA-vwxq-38j7-x48j"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SQL Injection in Clustering Communication (Hybrid Mode)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-1907",
"datePublished": "2026-10-12T08:38:54.485Z",
"dateReserved": "2026-02-04T15:21:03.888Z",
"dateUpdated": "2026-10-15T18:07:25.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14917 (GCVE-0-2026-14917)
Vulnerability from cvelistv5
Published
2026-09-16 10:06
Modified
2026-09-16 13:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Summary
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.
As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Kong | Kong Enterprise Gateway |
Version: 3.15.0.0 < 3.15.0.3 Version: 3.14.0.0 < 3.14.0.12 Version: 3.13.0.0 < 3.13.0.9 Version: 3.12.0.0 < 3.12.0.10 Version: 3.10.0.0 < 3.10.0.17 Version: 3.4.0.0 < 3.4.3.29 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:25:56.362396Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:26:06.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Kong Enterprise Gateway",
"vendor": "Kong",
"versions": [
{
"lessThan": "3.15.0.3",
"status": "affected",
"version": "3.15.0.0",
"versionType": "custom"
},
{
"lessThan": "3.14.0.12",
"status": "affected",
"version": "3.14.0.0",
"versionType": "custom"
},
{
"lessThan": "3.13.0.9",
"status": "affected",
"version": "3.13.0.0",
"versionType": "custom"
},
{
"lessThan": "3.12.0.10",
"status": "affected",
"version": "3.12.0.0",
"versionType": "custom"
},
{
"lessThan": "3.10.0.17",
"status": "affected",
"version": "3.10.0.0",
"versionType": "custom"
},
{
"lessThan": "3.4.3.29",
"status": "affected",
"version": "3.4.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.\u003c/p\u003e\u003cp\u003e\u003cspan\u003eAs a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators\u003c/span\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.\n\n\n\nAs a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:06:07.410Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://developer.konghq.com/gateway/changelog/#3-15-0-3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Kong API Gateway Enterprise: SAML Authentication bypass",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-14917",
"datePublished": "2026-09-16T10:06:07.410Z",
"dateReserved": "2026-07-07T07:14:57.290Z",
"dateUpdated": "2026-09-16T13:26:06.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6338 (GCVE-0-2026-6338)
Vulnerability from cvelistv5
Published
2026-06-11 13:47
Modified
2026-06-11 14:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-444 - Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')
Summary
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Kong | Kong Enterprise Gateway |
Version: 3.4.0.0 Version: 3.10.0.0 Version: 3.11.0.0 Version: 3.12.0.0 Version: 3.13.0.0 Version: 3.14.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:22:42.512428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:23:21.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Kong Enterprise Gateway",
"vendor": "Kong",
"versions": [
{
"lessThan": "3.4.3.27",
"status": "affected",
"version": "3.4.0.0",
"versionType": "kong enteprise gateway 3.4"
},
{
"lessThan": "3.10.0.12",
"status": "affected",
"version": "3.10.0.0",
"versionType": "kong enteprise gateway 3.10"
},
{
"lessThan": "3.11.0.12",
"status": "affected",
"version": "3.11.0.0",
"versionType": "kong enteprise gateway 3.11"
},
{
"lessThan": "3.12.0.7",
"status": "affected",
"version": "3.12.0.0",
"versionType": "kong enteprise gateway 3.12"
},
{
"lessThan": "3.13.0.5",
"status": "affected",
"version": "3.13.0.0",
"versionType": "kong enteprise gateway 3.13"
},
{
"lessThan": "3.14.0.4",
"status": "affected",
"version": "3.14.0.0",
"versionType": "kong enteprise gateway 3.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong\u2019s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.\u0026nbsp;"
}
],
"value": "A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong\u2019s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P/R:A/RE:M",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T13:47:01.309Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.konghq.com/support/s/article/CVE-2026-6338"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP request smuggling in Kong Enteprise Gateway",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-6338",
"datePublished": "2026-06-11T13:47:01.309Z",
"dateReserved": "2026-04-15T10:07:35.856Z",
"dateUpdated": "2026-06-11T14:23:21.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}