31 matches found
CVE-2026-1907
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
CVE-2026-1907
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
CVE-2026-1907
A SQL Injection (SQLi) vulnerability exists in the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode . The flaw is triggered by sending specially crafted RPC requests to the Control Plane (CP) , which could allow an attacker to achieve unauthor...
EUVD-2026-97300
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
PT-2026-110513
Name of the Vulnerable Software and Affected Versions Kong Gateway versions prior to 3.9.4 Description A SQL Injection SQLi exists in the clustering communication logic of Kong Gateway Enterprise and Open Source when operating in Hybrid Mode. An attacker can trigger this issue by sending speciall...
CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...
exploit-library
Exploit Library Personal collection of verified CVE exploits,...
CVE-2026-6338
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...
CVE-2026-6338
Kong Gateway Enterprise versions 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 are affected by a HTTP request smuggling and desynchronization vulnerability caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic. The issue can enable network‑level abus...
EUVD-2026-36246
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...
CVE-2026-6338 HTTP request smuggling in Kong Enteprise Gateway
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...
CVE-2026-6338 HTTP request smuggling in Kong Enteprise Gateway
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...
PT-2026-48667
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...
CVE-2026-6338: Inconsistent Interpretation of HTTP Requests
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...
Kong Gateway Enterprise environmental issues and vulnerabilities
Kong Gateway Enterprise is an enterprise-level API gateway platform developed by Kong Corporation. Versions 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 of Kong Gateway Enterprise contain environmental issues vulnerabilities. These vulnerabilities stem from defects in the HTTP request processing pipelin...
