Kong mcp-konnect EUVD-2026-41530

Exploitation requires that an LLM/AI agent connected to the Kong mcp-konnect server (versions before 1.0.0) processes attacker-controlled content - this is the UI:R interaction in the CVSS vector: the injection is 'indirect,' so the attacker does not act directly but must get poisoned data into the agent's context (e.g., via a data source, API response, or resource the MCP server exposes). No authentication or special privileges are needed on the attacker's side (PR:N). Limiting factors: the attack only succeeds if an agent actually ingests the malicious content and is authorized to make Konnect API calls, and the blast radius is bounded by the permissions of the credentials the MCP server uses; deployments where agents only consume fully trusted data are not realistically exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 7.4) indicates a network-reachable, low-complexity flaw needing no attacker privileges but requiring user/agent interaction (UI:R) - a victim agent must process the poisoned content for the injection to fire. The scope change (S:C) and C:H are the key drivers: injection in the model context crosses a trust boundary into the Konnect API authority and can disclose sensitive data. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - this is a real but interaction-gated risk rather than a wormable, drive-by threat. One tension to verify: NVD scores I:N (no integrity impact), yet the description says the attacker can 'execute unintended API requests,' which implies at least some state-changing capability; the confidentiality-only scoring may understate integrity risk depending on which Konnect endpoints the agent can reach. Prioritize based on whether your MCP agents ingest untrusted external content.

An attacker plants crafted instructions inside data that a Konnect-connected AI agent will later read - for example a resource name, description, or upstream API response the mcp-konnect server surfaces to the model. When the agent processes that content, the hidden directives are interpreted as commands, causing the agent to issue unintended Konnect API requests such as reading sensitive configuration or altering managed resources. No public exploit code is identified, but the low attack complexity means only a plausible content-injection foothold and a victim agent interaction are required.