Konghq - vulnerabilities (CVEs)

7 CVEs in 7 products, 0 in the last 30 days, newest from 2026-07-03.

Products

CVE-2026-13341 - CVSS 7.4 (high), 2026-07-03: A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-40299 - CVSS 7.8 (high), 2023-10-04: Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the…
CVE-2023-2418 - CVSS 5.9 (medium), 2023-04-29: A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The…
CVE-2020-36661 - CVSS 7.5 (high), 2023-02-12: A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file…
CVE-2021-27306 - CVSS 7.5 (high), 2021-03-18: An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes…
CVE-2020-11710 - CVSS 9.8 (critical), 2020-04-12: An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor…