unnamed
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
03
assessed vulnerabilities (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-1907US | — | — | ||
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending spe… | ||||
| CVE-2026-8462US | — | — | ||
SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify met… | ||||
| CVE-2026-14916US | — | — | ||
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affect… | ||||
| CVE-2026-14917US | —OT elevated | — | ||
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default.… | ||||
| CVE-2026-18674US | —OT elevated | — | ||
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the… | ||||
| CVE-2026-18679US | — | — | ||
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplan… | ||||
| CVE-2026-18678US | — | — | ||
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified conne… | ||||
| CVE-2026-18677US | — | — | ||
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp valid… | ||||
| CVE-2026-18676US | — | — | ||
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their… | ||||
| CVE-2026-18675US | — | — | ||
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runti… | ||||
| CVE-2026-18673US | —OT elevated | — | ||
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almos… | ||||
| CVE-2026-17578US | — | — | ||
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with rando… | ||||
| CVE-2026-18801US | — | — | ||
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.
An attacker who can create or update a customer c… | ||||
| CVE-2026-16543US | —OT elevated | — | ||
Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denia… | ||||
| CVE-2026-15228US | —OT elevated | — | ||
Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collect… | ||||
| CVE-2026-13341US | — | — | ||
A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection a… | ||||
| CVE-2026-6338US | — | — | ||
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing… | ||||
| CVE-2025-1087US | — | — | ||
Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insuffi… | ||||