Kong Enterprise Gateway
Monthly
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.