What is the CVSS score of CVE-2026-13341?

CVE-2026-13341 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kong mcp-konnect are affected by CVE-2026-13341?

Kong Konnect's Model Context Protocol server before version 1.0.0 is vulnerable to indirect prompt injection attacks that allow remote adversaries to manipulate API commands and access sensitive…. A patch is available.

How to fix or mitigate CVE-2026-13341?

Within 24 hours: Identify all Kong Konnect MCP deployments and document LLM agent data sources; assess exposure to untrusted input. Within 7 days: Implement strict input validation on agent data feeds; apply principle of least privilege to Kong API credentials; enable detailed audit logging. Within 30 days: Monitor Kong vendor security advisories for patch availability; evaluate deployment of separate credentialing for agent API access.

Kong mcp-konnect CVE-2026-13341

EUVD-2026-41530 HIGH

Improper Input Validation (CWE-20)

2026-07-03 Kong

GHSA-6pr5-9p6v-xxrq

Code Injection Mcp Konnect Konghq

7.4

CVSS 3.1 · Vendor: Kong

Severity by source

Vendor (Kong) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

8.2 HIGH

Network-reachable indirect injection needs no privileges but requires an agent to ingest attacker content (UI:R); crossing into the Konnect API authority is S:C with C:H, and I:L reflects state-changing unintended API requests.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (Kong).

CVSS VectorVendor: Kong

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 03, 2026 - 12:01 EUVD

Analysis Generated

Jul 03, 2026 - 11:16 vuln.today

DescriptionCVE.org

A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

AnalysisAI

Indirect prompt injection in the Kong Konnect Model Context Protocol (MCP) server (konghq mcp-konnect) before version 1.0.0 allows a remote attacker to smuggle malicious instructions into content that an LLM agent processes, causing the agent to issue unintended Kong Konnect API requests. Because the injected instructions execute with the trust and credentials of the connected agent, an attacker can exfiltrate sensitive Konnect data or drive management API calls the operator never intended. No public exploit identified at time of analysis, but the CVSS 7.4 rating (scope-changed, confidentiality-high) reflects meaningful impact once an agent ingests attacker-controlled data.

Technical ContextAI

The affected component is an MCP server (cpe:2.3:a:konghq:mcp-konnect), a bridge that exposes Kong Konnect API-management operations as tools an AI/LLM agent can invoke. MCP servers translate an agent's natural-language intent into concrete API calls, so any content the agent reads - API responses, resource descriptions, tool output - becomes part of the model's instruction context. The root cause is classified as CWE-20 (Improper Input Validation): the server does not adequately isolate or sanitize untrusted data before it reaches the model's decision loop, so attacker-planted text is interpreted as instructions ('indirect' prompt injection) rather than inert data. The Code Injection tag underscores that the injected directives are effectively executed as unintended API operations against the Konnect control plane.

RemediationAI

Vendor-released patch: 1.0.0 - upgrade the Kong mcp-konnect MCP server to version 1.0.0 or later, per Kong advisory GHSA-7767-3m3w-2p44 (https://github.com/Kong/mcp-konnect/security/advisories/GHSA-7767-3m3w-2p44). Until you can upgrade, reduce exposure by restricting the MCP server to trusted data sources so agents do not ingest attacker-controlled content (accepting reduced automation coverage), scoping the Konnect API credentials the server uses to least privilege and read-only where possible (which limits state-changing misuse but may break some agent workflows), and adding human-in-the-loop approval for any write or destructive Konnect operations the agent can trigger (which slows automation but blocks silent unintended requests). Monitor Konnect audit logs for anomalous API calls originating from the agent's service account.