A SQL Injection flaw exists in Kong Gateway’s clustering communication when running in Hybrid Mode, allowing an attacker to execute arbitrary SQL statements against the gateway’s database. The vulnerability is triggered by specially crafted remote procedure calls sent to the Control Plane, and if successful could expose, modify, or delete sensitive data stored in the database.

The flaw affects both Kong Enterprise Gateway and Kong Gateway (Open Source) deployments. No specific version range is listed in the CNA data; however, the advisory references a fix in the 3.13.0.2 release, so companies should verify that they are running this or later versions.

The CVSS score of 7.5 indicates high severity, and while EPSS is not available the lack of KEV listing does not diminish the risk. Exploitation requires network reach to the Control Plane’s clustering port and possession of a valid client certificate and key, meaning the threat is limited to trusted peers but still serious if the network is not tightly segmented.