CVE-2026-1907: SQL Injection in Clustering Communication (Hybrid Mode)
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Kong Gateway Enterprise and Open Source deployments operating in Hybrid Mode are affected in the clustering communication logic. An attacker must be able to reach the Control Plane clustering port.
What does an attacker need to exploit it?
The attacker needs network access to the Control Plane's clustering port and a valid client certificate and key. The issue is triggered through specially crafted RPC requests to the Control Plane.
What could successful exploitation allow?
Successful exploitation could provide unauthorized access to the database through SQL injection.