🔐 CVE Alert

CVE-2026-1907

UNKNOWN 0.0

SQL Injection in Clustering Communication (Hybrid Mode)

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

CWE CWE-89
Vendor kong
Product kong enterprise gateway
Published Oct 12, 2026
Stay Ahead of the Next One

Get instant alerts for kong kong enterprise gateway

Be the first to know when new unknown vulnerabilities affecting kong kong enterprise gateway are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Kong / Kong Enterprise Gateway
3.10.0.0 < 3.10.0.9 3.11.0.0 < 3.11.0.8 3.12.0.0 < 3.12.0.4 3.13.0.0 < 3.13.0.2
Kong / Kong Gateway
0 < 3.9.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗
developer.konghq.com: https://developer.konghq.com/gateway/changelog/#3-13-0-2 github.com: https://github.com/Kong/kong/security/advisories/GHSA-vwxq-38j7-x48j

Credits

🔍 four0four from ZeroVuln Labs