Executive brief
A vulnerability in the Kong Konnect Model Context Protocol (MCP) server could allow attackers to steal sensitive information by tricking AI assistants. By sending malicious data (like a fake User-Agent) to a public gateway, an attacker can inject hidden instructions that are later read by an AI agent using Kong's analytics tools. If the AI agent is not properly restricted, it might follow these hidden instructions to leak secret credentials, plugin configurations, or internal system details to the attacker.
Technical details
The Kong Konnect MCP server prior to version 1.0.0 is susceptible to indirect prompt injection via untrusted analytics data and path manipulation in control plane identifiers. Attackers can inject malicious instructions into request metadata (e.g., User-Agent) which is stored in Konnect analytics; when an MCP-connected AI assistant retrieves this data, it may execute the injected prompts. If the AI agent lacks outbound network restrictions, this can result in the exfiltration of secrets, plugin configurations, and operational metadata. Additionally, improper validation of control plane and group identifiers allows for path manipulation, potentially forcing the MCP server to make unauthorized requests to the Konnect API using the user's token. The issue is fixed in version 1.0.0, which introduces input neutralization, UUID validation, and stricter output policies for plugin configurations.
Affected products
- KongHQ mcp-konnect < 1.0.0
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published by Kong
- 2026-07-03: disclosed: CVE published to NVD
- 2026-07-03: patched: Version 1.0.0 released with fixes