CVE-2026-1907: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in Kong Kong Enterprise Gateway

This vulnerability (CVE-2026-1907) involves improper neutralization of special elements in SQL commands (CWE-89) within Kong Enterprise Gateway's clustering communication logic in Hybrid Mode. An attacker with network access to the Control Plane's clustering port and valid client certificate and key can send crafted RPC requests that trigger SQL Injection, potentially leading to unauthorized database access. The vulnerability affects versions >=0 <3.9.4, >=3.10.0.0 <3.10.0.9, >=3.11.0.0 <3.11.0.8, >=3.12.0.0 <3.12.0.4, and >=3.13.0.0 <3.13.0.2.

Successful exploitation can lead to unauthorized database access via SQL Injection in the Control Plane's clustering communication. This could compromise sensitive data or affect the integrity of the database. However, exploitation requires network access to the Control Plane clustering port and possession of valid client certificates and keys, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Control Plane clustering port and tightly control client certificate issuance to mitigate risk.