CVE-2026-1907CWE-89sql-injection

CVE-2026-1907

published October 12, 2026

CVSS
7.5
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

The record
Technical detail
CVSS
7.5 · NONE
CVSS v4.0
7.5 · CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00131 · 2.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-12T13:16Z
References (2)
https://developer.konghq.com/gateway/changelog/#3-13-0-2 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/Kong/kong/security/advisories/GHSA-vwxq-38j7-x48j · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
EPSS history
Timeline
  • 13 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 12 OCT 08:38Z
    SQL Injection in Clustering Communication (Hybrid Mode)
    cvelistv5
  • 12 OCT 08:38Z
    SQL Injection in Clustering Communication (Hybrid Mode)
    cvelistv5