CVE-2026-92544: SQL Injection

Published Nov 10, 2026

Updated

SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name.

Affected Software

2 affected components

kong Kong Gateway Enterprise

kong Kong AI Gateway

Event History

Nov 10, 2026

CVE Published

via MITRE·09:11 PM

Data Sourced

via MITRE·09:11 PM

DescriptionWeakness

Data Sourced

via NVD·09:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs client-level access and must be able to submit a crafted model name to the affected LLM usage counters. No user interaction is required, and the attack is reachable over the network.

What could successful exploitation allow?

A successful attack may allow arbitrary SQL execution against the Kong database. The supplied severity vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component, with high confidentiality impact on subsequent systems.

Which Kong products are affected?

The issue affects Kong Gateway Enterprise and Kong AI Gateway. The provided information does not identify affected or fixed versions.

CVE-2026-92544: SQL Injection

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which Kong products are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which Kong products are affected?