CVE-2026-1907
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Kong Enterprise Gateway
- Vendor
- Kong
- Product
- Kong Enterprise Gateway
- Platforms
- Linux
- Default status
unaffected- Package
- kong-ee
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 3.10.0.0 | affected | kong ee gateway 3.10 | 3.10.0.9 | Unavailable | None listed |
| 3.11.0.0 | affected | kong ee gateway 3.11 | 3.11.0.8 | Unavailable | None listed |
| 3.12.0.0 | affected | kong ee gateway 3.12 | 3.12.0.4 | Unavailable | None listed |
| 3.13.0.0 | affected | kong ee gateway 3.13 | 3.13.0.2 | Unavailable | None listed |
Kong Gateway
- Vendor
- Kong
- Product
- Kong Gateway
- Platforms
- Unknown
- Default status
unaffected- Package
- kong
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | Kong Gateway 3.4 | 3.9.4 | Unavailable | None listed |