CVE-2026-1907 (GCVE-0-2026-1907)
Vulnerability from cvelistv5
Published
2026-10-12 08:38
Modified
2026-10-15 18:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Summary
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Kong | Kong Enterprise Gateway |
Version: 3.10.0.0 Version: 3.11.0.0 Version: 3.12.0.0 Version: 3.13.0.0 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:57:43.665281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:07:25.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "kong-ee",
"platforms": [
"Linux"
],
"product": "Kong Enterprise Gateway",
"vendor": "Kong",
"versions": [
{
"lessThan": "3.10.0.9",
"status": "affected",
"version": "3.10.0.0",
"versionType": "kong ee gateway 3.10"
},
{
"lessThan": "3.11.0.8",
"status": "affected",
"version": "3.11.0.0",
"versionType": "kong ee gateway 3.11"
},
{
"lessThan": "3.12.0.4",
"status": "affected",
"version": "3.12.0.0",
"versionType": "kong ee gateway 3.12"
},
{
"lessThan": "3.13.0.2",
"status": "affected",
"version": "3.13.0.0",
"versionType": "kong ee gateway 3.13"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "kong",
"product": "Kong Gateway",
"repo": "https://github.com/Kong/kong",
"vendor": "Kong",
"versions": [
{
"lessThan": "3.9.4",
"status": "affected",
"version": "0",
"versionType": "Kong Gateway 3.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "four0four from ZeroVuln Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eA SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane\u2019s clustering port and a valid client certificate and key.\u003cbr\u003e\u003c/pre\u003e"
}
],
"value": "A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane\u2019s clustering port and a valid client certificate and key."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T08:38:54.485Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://developer.konghq.com/gateway/changelog/#3-13-0-2"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Kong/kong/security/advisories/GHSA-vwxq-38j7-x48j"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SQL Injection in Clustering Communication (Hybrid Mode)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-1907",
"datePublished": "2026-10-12T08:38:54.485Z",
"dateReserved": "2026-02-04T15:21:03.888Z",
"dateUpdated": "2026-10-15T18:07:25.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-1907\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T17:57:43.665281Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T17:57:44.312Z\"}}], \"cna\": {\"title\": \"SQL Injection in Clustering Communication (Hybrid Mode)\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"four0four from ZeroVuln Labs\"}], \"impacts\": [{\"capecId\": \"CAPEC-66\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-66 SQL Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Kong\", \"product\": \"Kong Enterprise Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.10.0.0\", \"lessThan\": \"3.10.0.9\", \"versionType\": \"kong ee gateway 3.10\"}, {\"status\": \"affected\", \"version\": \"3.11.0.0\", \"lessThan\": \"3.11.0.8\", \"versionType\": \"kong ee gateway 3.11\"}, {\"status\": \"affected\", \"version\": \"3.12.0.0\", \"lessThan\": \"3.12.0.4\", \"versionType\": \"kong ee gateway 3.12\"}, {\"status\": \"affected\", \"version\": \"3.13.0.0\", \"lessThan\": \"3.13.0.2\", \"versionType\": \"kong ee gateway 3.13\"}], \"platforms\": [\"Linux\"], \"packageName\": \"kong-ee\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/Kong/kong\", \"vendor\": \"Kong\", \"product\": \"Kong Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.9.4\", \"versionType\": \"Kong Gateway 3.4\"}], \"packageName\": \"kong\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://developer.konghq.com/gateway/changelog/#3-13-0-2\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://github.com/Kong/kong/security/advisories/GHSA-vwxq-38j7-x48j\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane\\u2019s clustering port and a valid client certificate and key.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003eA SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane\\u2019s clustering port and a valid client certificate and key.\u003cbr\u003e\u003c/pre\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\", \"shortName\": \"Kong\", \"dateUpdated\": \"2026-10-12T08:38:54.485Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-1907\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T18:07:25.891Z\", \"dateReserved\": \"2026-02-04T15:21:03.888Z\", \"assignerOrgId\": \"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\", \"datePublished\": \"2026-10-12T08:38:54.485Z\", \"assignerShortName\": \"Kong\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…