CVE-2026-1907

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1907
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1907
Aliases
  • GHSA-vwxq-38j7-x48j
Published
2026-10-12T08:38:54Z
Modified
2026-10-18T02:45:11Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SQL Injection in Clustering Communication (Hybrid Mode)
Details

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.

Database specific 
{
    "cna_assigner":  "Kong",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1907.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3.10.0.0"
                },
                {
                    "fixed":  "3.10.0.9"
                },
                {
                    "introduced":  "3.11.0.0"
                },
                {
                    "fixed":  "3.11.0.8"
                },
                {
                    "introduced":  "3.12.0.0"
                },
                {
                    "fixed":  "3.12.0.4"
                },
                {
                    "introduced":  "3.13.0.0"
                },
                {
                    "fixed":  "3.13.0.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/kong/kong

Affected ranges

Type
GIT
Repo
https://github.com/kong/kong
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ddc85be461165c9eb4506669343aa0d0c627e687
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.9.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0beta-3
0.1.1beta-2
0.10.0
0.11.0
0.13.0rc1
0.13.0rc2
0.2.0-2
0.2.1
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.5.0
0.5.1
0.8.0
0.8.3
0.9.0
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.0.0rc2
1.0.0rc4
1.1.0
1.1.0rc1
1.1.1
1.1.2
1.2.1
1.2.2
1.4.0
2.*
2.0.0rc1
2.0.0rc2
2.0.2
2.0.3
2.0.4
2.4.0
2.4.0-beta.2
2.4.0-rc.1
3.*
3.9.1
3.9.2
3.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1907.json"