Vulnerabilidades de Kong
CVEs publicadas que afetam produtos de Kong: 2 registro(s), com severidade, exploração e correções.
CVE-2026-1907
Alta · 7.5
CWE-89 12/10/2026
SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.
CVE-2026-6338
Média · 4.9
CWE-444 11/06/2026
HTTP request smuggling in Kong Enteprise Gateway
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.