Read the docs
TI-2026-70893 Aliases CVE-2026-1907GHSA-gjvg-7rjg-jm9f

SQL injection in Kong Gateway clustering communication

Priority LOW 34CWE-89Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Kong Enterprise Gateway from 3.10.0.0 before 3.10.0.9, 3.11.0.0 before 3.11.0.8, 3.12.0.0 before 3.12.0.4 and 3.13.0.0 before 3.13.0.2, and Kong Gateway before 3.9.4 are affected in Hybrid Mode. SQL injection (CWE-89) in the clustering communication lets crafted RPC requests sent to the Control Plane reach the database. An attacker needs network access to the clustering port and a valid client certificate and key. This allows unauthorized database access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00133 2nd percentileScored 2026-11-07
Fix Fixed Kong Enterprise Gateway (Kong): 3.10.0.9, 3.11.0.8, 3.12.0.4 +1Kong Gateway (Kong): 3.9.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kong Inc.Kong Enterprise Gateway3.10.0.0 to before 3.10.0.9; 3.11.0.0 to before 3.11.0.8; 3.12.0.0 to before 3.12.0.4; 3.13.0.0 to before 3.13.0.23.10.0.9, 3.11.0.8, 3.12.0.4, 3.13.0.2Patch availableCNA
Kong Inc.Kong Gatewaybefore 3.9.43.9.4Patch availableCNA
  • Kong Enterprise Gateway VendorKong Inc. Affected 3.10.0.0 to before 3.10.0.9; 3.11.0.0 to before 3.11.0.8; 3.12.0.0 to before 3.12.0.4; 3.13.0.0 to before 3.13.0.2 Fixed in 3.10.0.9, 3.11.0.8, 3.12.0.4, 3.13.0.2 Patch available CNA
  • Kong Gateway VendorKong Inc. Affected before 3.9.4 Fixed in 3.9.4 Patch available CNA

Remediation

Fixed versions are Kong Enterprise Gateway 3.10.0.9, 3.11.0.8, 3.12.0.4 and 3.13.0.2 for the matching branch, and Kong Gateway 3.9.4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Kong Enterprise Gateway (Kong) Fixed in 3.10.0.9, 3.11.0.8, 3.12.0.4, 3.13.0.2
  • Fix · CNA Kong Gateway (Kong) Fixed in 3.9.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-1907
  2. 2026-10-12 Alias added: GHSA-gjvg-7rjg-jm9f
  3. 2026-10-12 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 1

  • TI-2020-17871 The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank… CVSS 3.1CRITICAL 9.8
  • TI-2025-00925 Arbitrary Code Execution in Kong Insomnia Desktop Application CVSS 4.0CRITICAL 9.3
  • TI-2026-12562 Kong API Gateway Enterprise: SAML Authentication bypass CVSS 4.0HIGH 7.7
  • TI-2026-12561 Kong API Gateway Enterprise: JWT Algorithm-Confusion CVSS 4.0HIGH 7.7
  • TI-2020-18854 Kong lua-multipart multipart.lua is_header redos CVSS 3.1HIGH 7.5
  • TI-2025-01158 Kong Insomnia profapi.dll untrusted search path CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences