CVE-2026-1907

SQL Injection in Clustering Communication (Hybrid Mode)

State: Published
Severity: 7.5 High
Published: Oct 12, 2026
Updated: Oct 15, 2026
Reserved: Feb 4, 2026

Description

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

Scores

CVSS	Score	Vector	Source
4.0	7.5 High	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Kong

Weaknesses

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Affected Products

Product	Versions
Kong Enterprise GatewayKong	3.10.0.0 to before 3.10.0.9Affected 3.11.0.0 to before 3.11.0.8Affected 3.12.0.0 to before 3.12.0.4Affected 3.13.0.0 to before 3.13.0.2Affected
Kong GatewayKong	before 3.9.4Affected

References

https://developer.konghq.com/gateway/changelog/#3-13-0-2release-notes
https://github.com/Kong/kong/security/advisories/GHSA-vwxq-38j7-x48jvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.