https://vulnogram.org/ Most recent CVEs assigned by Kong Inc. (kong). https://vulnogram.org/seaview/icons/kong.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-1907 https://vulnogram.org/CVE-2026-1907 A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to pote… High Mon, 12 Oct 2026 08:38:54 GMT https://vulnogram.org/CVE-2026-8462 https://vulnogram.org/CVE-2026-8462 SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted… High Network Exploitable Wed, 16 Sep 2026 10:14:34 GMT https://vulnogram.org/CVE-2026-14916 https://vulnogram.org/CVE-2026-14916 A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is c… High Network Exploitable Wed, 16 Sep 2026 10:11:15 GMT https://vulnogram.org/CVE-2026-14917 https://vulnogram.org/CVE-2026-14917 A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsign… High Network Exploitable Wed, 16 Sep 2026 10:06:07 GMT https://vulnogram.org/CVE-2026-18674 https://vulnogram.org/CVE-2026-18674 On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticate… High Mon, 17 Aug 2026 12:08:11 GMT https://vulnogram.org/CVE-2026-18679 https://vulnogram.org/CVE-2026-18679 When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-… Medium Wed, 12 Aug 2026 18:52:31 GMT https://vulnogram.org/CVE-2026-18678 https://vulnogram.org/CVE-2026-18678 When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the co… Medium Wed, 12 Aug 2026 18:49:45 GMT https://vulnogram.org/CVE-2026-18677 https://vulnogram.org/CVE-2026-18677 In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload.… Medium Wed, 12 Aug 2026 18:47:06 GMT https://vulnogram.org/CVE-2026-18676 https://vulnogram.org/CVE-2026-18676 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a… Medium Network Exploitable Wed, 12 Aug 2026 18:42:38 GMT https://vulnogram.org/CVE-2026-18675 https://vulnogram.org/CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. Th… Medium Wed, 12 Aug 2026 18:36:17 GMT https://vulnogram.org/CVE-2026-18673 https://vulnogram.org/CVE-2026-18673 When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, wi… Medium Wed, 12 Aug 2026 18:20:33 GMT https://vulnogram.org/CVE-2026-17578 https://vulnogram.org/CVE-2026-17578 Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer… Low Wed, 05 Aug 2026 10:20:55 GMT https://vulnogram.org/CVE-2026-18801 https://vulnogram.org/CVE-2026-18801 OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttributio… Critical Network Exploitable Tue, 04 Aug 2026 14:53:01 GMT https://vulnogram.org/CVE-2026-16543 https://vulnogram.org/CVE-2026-16543 Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across… High Wed, 29 Jul 2026 15:29:03 GMT https://vulnogram.org/CVE-2026-15228 https://vulnogram.org/CVE-2026-15228 Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label s… High Wed, 29 Jul 2026 15:28:30 GMT https://vulnogram.org/CVE-2026-13341 https://vulnogram.org/CVE-2026-13341 A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests. High Network Exploitable Fri, 03 Jul 2026 10:19:10 GMT https://vulnogram.org/CVE-2026-6338 https://vulnogram.org/CVE-2026-6338 A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untruste… Medium Network Exploitable Thu, 11 Jun 2026 13:47:01 GMT https://vulnogram.org/CVE-2025-1087 https://vulnogram.org/CVE-2025-1087 Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strin… Critical Network Exploitable Fri, 09 May 2025 11:37:49 GMT