VulnSocial

CVE-2026-1907

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 1 mentions (2026-10-12); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-10-12: 1Mentions · 2026-10-13: 110-1210-13
Referenced assets1 URL
Full discourse2 posts
  • Relnx@relnxio

    Running Kong Gateway in Hybrid Mode? Patch your control plane. Kong 3.9.4 fixes CVE-2026-1907 (HIGH): SQL injection via crafted clustering RPC calls to the CP. Needs a valid client cert, so the risk is a compromised data plane. https://www.relnx.io/releases/kong-v3-9-4?utm_source=x&utm_medium=social&utm_campaign=2026-10-12_C #Kong

    0202043
    8 followersView on X
  • Relnx@relnxio

    Last week in cloud-native: 86 releases, 33 tools. 3 worth acting on: 1. Argo CD: 8 advisories, 4 critical. Take 3.5.5 / 3.4.11 / 3.3.16 2. Kong 3.9.4: CVE-2026-1907 SQLi in Hybrid Mode (HIGH) 3. Jaeger 2.22.0: 8 breaking changes in query + ES config Which one is in your stack? https://t.co/PSClnCssr0

    0000025
    8 followersView on X

Explore more

Back to dashboard