The vulnerability CVE-2026-13341 affects KongHQ's mcp-konnect product, specifically the MCP server before version 1.0.0. It is caused by improper input validation (CWE-20), which could allow a remote attacker to indirectly inject prompts that result in unintended API requests being executed. The CVSS 3.1 vector indicates network attack vector with low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. No official patch or remediation level has been published by the vendor as of now.

Successful exploitation could lead to unauthorized disclosure of sensitive information due to the high confidentiality impact. There is no impact on integrity or availability according to the CVSS vector. The attacker must have network access and induce user interaction to trigger the vulnerability. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigation or workaround is provided by the vendor at this time.