Kong Gateway
Monthly
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.