Kong

Latest CVEs · RSS

• CVE-2026-1907 2026-10-12 · CVSS 7.5
  A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be trig
• CVE-2026-8462 2026-09-16 · CVSS 8.9
  SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to
• CVE-2026-14916 2026-09-16 · CVSS 7.7
  A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway En
• CVE-2026-14917 2026-09-16 · CVSS 7.7
  A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is
• CVE-2026-18674 2026-08-17 · CVSS 7.0
  On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identi
• CVE-2026-18679 2026-08-12 · CVSS 5.8
  When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabl
• CVE-2026-18678 2026-08-12 · CVSS 5.5
  When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over
• CVE-2026-18677 2026-08-12 · CVSS 6.0
  In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authentica
• CVE-2026-18676 2026-08-12 · CVSS 5.1
  The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is
• CVE-2026-18675 2026-08-12 · CVSS 5.3
  The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64
• CVE-2026-18673 2026-08-12 · CVSS 5.3
  When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfa
• CVE-2026-17578 2026-08-05 · CVSS 2.3
  Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryp
• CVE-2026-18801 2026-08-04 · CVSS 9.3
  OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or
• CVE-2026-16543 2026-07-29 · CVSS 7.1
  Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress
• CVE-2026-15228 2026-07-29 · CVSS 7.1
  Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of
• CVE-2026-13341 2026-07-03 · CVSS 7.4
  A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirec
• CVE-2026-6338 2026-06-11 · CVSS 4.9
  A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is
• CVE-2025-1087 2025-05-09 · CVSS 9.3
  Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability e