Wukong AICRM through version 0 contains a missing authorization vulnerability in the /systemConfig controller. This flaw allows any authenticated user to retrieve the stored AI provider API key in cleartext by accessing specific endpoints. The vulnerability enables attackers to either request the key directly or forward it to an external host via crafted API calls.
Wukong AICRM up to version 0 contains a missing authorization vulnerability that allows any authenticated user to access sensitive administration APIs without proper administrator checks. This flaw enables attackers to reset the admin password and assign themselves full administrator privileges, resulting in complete account takeover.
CVE-2026-1907 is a SQL Injection vulnerability in Kong Enterprise Gateway's clustering communication logic when operating in Hybrid Mode. It can be exploited by sending specially crafted RPC requests to the Control Plane, requiring network access to the Control Plane’s clustering port and valid client credentials. This vulnerability affects multiple versions of Kong Enterprise Gateway prior to specific patched releases. The CVSS 4.0 score is 7.5, indicating a high severity issue.
CVE-2026-108708 is a missing authorization vulnerability in Wukong_HRM version 0. This flaw allows any authenticated low-privileged employee to gain HR administrator privileges improperly, enabling them to access sensitive data such as payslips, salary records, and bank cards. Additionally, they can edit bank card information and delete employees, departments, and contracts across the company.
Wukong_HRM version 0 contains an authentication bypass vulnerability in the ParamAspect component. This flaw allows unauthenticated attackers to access all HRM API endpoints by omitting the AUTH-TOKEN header. Exploitation grants attackers HR administrator privileges, enabling them to read sensitive employee data such as payslips and salary history, download attachments, and modify or delete company-wide HR records. The vulnerability has a critical CVSS 4.0 score of 9.3.
Wukong AICRM through version 0 contains an authorization bypass vulnerability that allows authenticated users to write messages into other users' AI chat sessions by specifying arbitrary session IDs. This enables attackers to append messages to victims' conversations and receive assistant replies based on the victim's recent messages, potentially disclosing conversation content.
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification.
As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.
As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
CVE-2026-18674 is a vulnerability in Kong Inc.'s Kong Mesh affecting specific versions where the global control plane incorrectly attributes resources received over the zone-to-global KDS sync using a sender-controlled identifier rather than the authenticated zone identity. This flaw allows an authenticated zone to inject, attribute, and overwrite resources in another zone's namespace, resulting in a cross-zone isolation bypass.
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token
A single request is a transient interruption; sustaining an outage requires repeated requests.
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication.
An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 have a vulnerability where key rotation is not enforced before reaching the NIST recommended usage limit for AES-GCM encryption keys with random nonces when AWS IAM encryption is enabled. This can lead to nonce reuse, increasing the risk of nonce collisions. An authorized consumer detecting such a collision could recover parts of plaintext from affected messages. Versions 1.1.2 and 1.2.1 address this issue by enforcing automatic key rotation before the usage limit is reached.
A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.
The hk_shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title-plane' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankong_post_short_title_plane() function, where the 'title' attribute is concatenated directly into HTML output without any escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.